cc-safety-net 2.4.11 → 2.4.12

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,49 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.11
+// version: 2.4.12
 // @bun
-var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Pn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Si={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},An={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...Si},processedCandidateBytes:{cap:4194304,...Si},pathEnvironmentExpansion:{cap:64,...Si},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...An},trackedHeredocFiles:{cap:64,...An},controlFlowStates:{cap:64,...An},wrapperPeelIterations:{cap:20,...An},derivedCommandShape:An});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function be(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Mp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ct(e){return Dp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Dp(e){return Mp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Np={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Lp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Np[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Dn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Mn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Mn},trackedHeredocFiles:{cap:64,...Mn},controlFlowStates:{cap:64,...Mn},wrapperPeelIterations:{cap:20,...Mn},derivedCommandShape:Mn});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Fp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function mt(e){return zp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function zp(e){return Fp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Bp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function $p(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Bp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function Sl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function Tn(e={}){return{reason:Pn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function Cl(e){return Lp({...e,redact:ct})}function vl(e){return ct(e instanceof Error?e.message:String(e))}import{types as Wp}from"util";var Gp=new Set(["applypatch","patch"]),Fp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),zp=new Set(["grep","grepsearch","rg"]),$p=new Set(["find","findbyname","glob"]),Bp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Up=new Set(["command","diff","input","patch","patchtext"]),El=new TextEncoder,Hp=new TextDecoder,jp=/\s/,Vp=64;class Xe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var In=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Al(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Tr(e){return Bp.has(Al(e))}function Ri(e){let t=Al(e);if(Gp.has(t))return"patch";if(zp.has(t))return"grep";if($p.has(t))return"glob";if(Fp.has(t))return"path";return"unknown"}function On(e){if(!e||typeof e!=="object")return;Dl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Pl(e,t){return Tl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Tl(e,t,n,r){let o=Ml(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Tl(a,t,n,r+1);return typeof a==="string"&&t.has(Il(s))?[a]:l});return n.ancestors.delete(o.object),i}function Il(e){return e.replace(/-/g,"_").toLowerCase()}function kl(e){return Ol(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(qp)}function Ol(e,t,n,r){let o=Ml(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ol(a,o.array?t:Up.has(Il(s)),n,r+1));return n.ancestors.delete(o.object),i}function Kp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>In.maxDepth||t.nodes>In.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>In.maxStringBytes||t.stringBytes>In.maxAggregateStringBytes)Ve()}function Ml(e,t,n){if(Kp(e,t,n),!e||typeof e!=="object")return null;let r=Dl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>In.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Dl(e){if(Wp.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Xe}function qp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Yp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...vi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...vi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...xi(Pr(c.slice(4),!0),Pr(u.slice(4),!0))),l++;continue}if(!r)t.push(...vi(c))}return t}function Yp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function vi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return wl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return wl(n[1]);if(e.startsWith("diff --git "))return Zp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return _l(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return _l(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return rg(i[1]);return[]}function Zp(e){let t=Xp(e);if(t.length===2&&t[0]&&t[1])return xi(t[0],t[1]);let n=Jp(e);return n?xi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Xp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Nl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Jp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Vp)Ve();if(Qp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Qp(e,t,n,r,o){if(Ei(e,t,n,r,o))return!0;let i=xl(e,"/",t,n),s=xl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ei(e,t,i,r,s))return!1;return Ei(e,i+1,n,s+1,o)}function Ei(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function xl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&jp.test(e)}function Nl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Hp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...El.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...El.encode(eg(s[0]??""))),o+=2}return null}function eg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function tg(e){return kn(og(e))}function xi(e,t){if(e==="/dev/null")return Rl(t);if(t==="/dev/null")return Rl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(kn);let n=ng(e,t)??(e===t?Ll(e):null);return[e,t,...n?[n]:[]].flatMap(kn)}function Rl(e){let t=Ll(e);return[e,...t?[t]:[]].flatMap(kn)}function Ll(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function ng(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function _l(e){return tg(Pr(e,!0))}function rg(e){return kn(Pr(e,!1))}function Pr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Nl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function og(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function kn(e){return e===""||e==="/dev/null"?[]:[e]}function wl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ii,relative as fg,resolve as Ul,sep as pg}from"path";import{basename as Fl,dirname as ig,isAbsolute as sg,join as ag,normalize as lg,resolve as Wl}from"path";var cg=256,Ir=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Se(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Je(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Pi(e,t){return _i(e,0,t)}function _i(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=wi(e,o+2),a=ug(e,o,t);if(a===null){if(Ir.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=dg(l,t,n),o=a+1;continue}let i=wi(e,o+1);if(!i){r+="$",o++;continue}r+=Ai(i,n)??`$${i}`,o+=i.length+1}return r}function ug(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function dg(e,t,n){let r=e.slice(2,-1),o=wi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ai(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ir.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Ir.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=Ai(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":_i(i.slice(s.length),t+1,n);return l?_i(i.slice(s.length),t+1,n):""}function wi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ai(e,t){if(!Ir.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){zl(n,i);let s=t.realpath(i);if(s!==null)return Gl(n,e,s,o);let a=ig(i);if(a===i||o.length>=cg)return Gl(n,e,i,o);o.push(Fl(i)),i=a}}function Gl(e,t,n,r){let o=r.length===0?n:ag(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function mg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;zl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function zl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=Bl(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function $l(e,t,n,r,o){let i=Bl(e,t,n);if(!i)return null;if(o(Fl(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=mg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Bl(e,t,n){let r=n.home,o=Pi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Wl(r,o.slice(2)):o,s=Se(i);return lg(sg(s)?s:Wl(t,s))}function Hl(e,t,n){if(Je(e))return;let r=t.flatMap((i)=>Ti(i,n));if(!r[0])return;let o=Ti(Ii(e)?e:Ul(r[0],e),n)[0];if(!o)return;return r.some((i)=>gg(o,i))?o:void 0}function jl(e,t,n){if(Je(e))return;return Ti(Ii(e)?e:Ul(t,e),n)[0]}function Ti(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function gg(e,t){let n=fg(t,e);return n===""||n!==".."&&!n.startsWith(`..${pg}`)&&!Ii(n)}function Yt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Ug,realpathSync as Hg,statSync as jg}from"fs";import{homedir as Vg,tmpdir as Kg}from"os";import{statSync as zg}from"fs";import{join as $g}from"path";import{spawnSync as hg}from"child_process";import{existsSync as Dn,lstatSync as yg,readFileSync as Nn,realpathSync as Zt,statSync as Mn}from"fs";import{dirname as ki,isAbsolute as Oi,join as Xt,resolve as kr}from"path";var bg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Sg=5000;function Kl(e,t=Lg(),n=Sg){let r=Cg(e),o=r===null?null:vg(r);if(r===null||o===null)return null;let i=Dg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Cg(e){try{let t=Zt(kr(e));return Mn(t).isDirectory()?t:null}catch{return null}}function vg(e){let t=Mg(e);if(!t)return null;try{let n=yg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Mi(t);if(!r?.commonDir)return null;if(!Rg(r.gitDir,t))return null;return _g(r.gitDir,ki(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Mi(e){try{let t=Eg(e);if(!t)return null;let n=Zt(Oi(t)?t:kr(ki(e),t));if(!Mn(n).isDirectory())return null;return{gitDir:n,commonDir:xg(n)}}catch{return null}}function Eg(e){let t=Nn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function xg(e){try{let t=Nn(Xt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Zt(Oi(t)?t:kr(e,t));return Mn(n).isDirectory()?n:null}catch{return null}}function Rg(e,t){let n=wg(e);return n===null?!1:ql(e,n,t)}function _g(e,t){let n=Ag(e);return n===null?!0:ql(e,n,t)}function wg(e){let t=Xt(e,"gitdir");if(!Dn(t))return null;let n=Nn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Ag(e){let t=Xt(e,"config.worktree");return Dn(t)?Tg(t):null}function ql(e,t,n){try{return Pg(Oi(t)?t:kr(e,t),n)}catch{return!1}}function Pg(e,t){try{let n=Mn(e),r=Mn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Vl(Zt.native(e))===Vl(Zt.native(t))}function Vl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Tg(e){let t=Nn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Ig(s[1]??"")}return r}function Ig(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Og(t.slice(1,-1))}var kg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Og(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:kg[n]??t)}function Mg(e){try{return Di(Zt(e))}catch{return null}}function Di(e){let t=e;while(!0){let n=Xt(t,".git");if(Dn(n))return n;let r=ki(t);if(r===t)return null;t=r}}function Dg(e,t,n,r){if(Ng(t))return!0;if(n===null)return!0;let o=hg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Wg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Yl(o.stdout.trim())}function Ng(e){return[Xt(e.commonDir,"config"),Xt(e.gitDir,"config.worktree")].filter((t)=>Dn(t)).some((t)=>Gg(t))}function Lg(){return bg.find((e)=>Dn(e))??null}function Ln(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Wg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Ln(t)))}function Gg(e){let t;try{t=Nn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Fg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Yl(c)}return r}function Fg(e){return e==="include"||e.startsWith("includeif ")}function Yl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Zl(e,t){if(e==="")return null;let n=be(),r=Di(se(e,e,t,n)),o=r?Bg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Bg(e,t,n,r){try{let o=se(e,t,n,r),i=zg(e),s=i.isFile()?o:null,a=i.isFile()?Mi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Jt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Jt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Jt(o),markerFile:s?Jt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Jt($g(u,"hooks").replace(/\\/g,"/"));return[m,Jt(se(m,t,n,r))]}))]}}catch{return null}}function Jt(e){return process.platform==="win32"?e.toLowerCase():e}var qg={realpath:(e)=>{try{return Hg(e)}catch{return null}},entryKind:(e)=>{let t=Ug(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return jg(e).isDirectory()}catch{return!1}}};function Jl(){return Yg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Se(process.env.HOME||Vg()),tmpdir:Kg(),paths:qg})}function Yg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Xl(n,i,()=>Zl(i,o)),worktreeFacts:(i)=>Xl(r,i,()=>Kl(i)),...t};return o}function Xl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Qt=["fail_closed","paranoid_rm","paranoid_interpreters"],Or={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Mr=["standard","strict","paranoid"];function Zg(e,t){if(!t)return e;return Mr.indexOf(t)>Mr.indexOf(e)?t:e}function Xg(e){let t=Gi(Q.level,e);if(t===void 0||t==="")return;if(Mr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Mr.join(", ")}.`);return}function Jg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Ql(e){return Jg(Gi(Q.auditScope,e))==="all"}function Li(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Wi(e={},t){let n=e.safety?.level??"standard",r=Xg(t),o=Zg(n,r),i=Or[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Li(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?Ni(e,t):Gi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Ni(e,t){return t.get(e)}function Gi(e,t){let n=Ni(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Ni(e.legacyName,t);return}import{dirname as Br}from"path";import{closeSync as Qg,constants as ec,fstatSync as eh,fsyncSync as TP,lstatSync as $i,mkdirSync as IP,openSync as th,readdirSync as kP,readFileSync as nh,realpathSync as Bi,renameSync as OP,rmdirSync as MP,statSync as rh,unlinkSync as DP,writeFileSync as NP}from"fs";import{isAbsolute as tc,join as Ui,normalize as oh,parse as zi,relative as Hi,resolve as ji,sep as Vi}from"path";function Fi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var ih=Symbol("PolicyFilesystemScope"),sh=Symbol("PolicyFilesystemTarget"),ah=ec.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[ih]:!0,root:ji(e),label:t}}function nc(e,t){let n=oh(t);if(t===""||tc(t)||n===".."||n.startsWith(`..${Vi}`))throw new ae(e.label);return{[sh]:!0,scope:e,relativePath:n,path:Ui(e.root,n)}}function Wn(e,t){return nc(e,Hi(e.root,ji(t)))}function rc(e,t="rules policy"){let n=ji(e),r=zi(n).dir;return nc(_t(r,t),Hi(r,n))}function Nr(e){return ic(e.scope.label,()=>{if(!Dr(e))return null;let t=th(e.path,ec.O_RDONLY|ah);return lh(t,()=>{let n=eh(t);if(!n.isFile())throw new ae(e.scope.label);let r=nh(t,"utf-8"),o=$i(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Dr(e),r})})}function oc(e,t){if(e.path===t.path)return!0;return ic(e.scope.label,()=>{if(!Dr(e)||!Dr(t))return!1;let n=(r)=>Ui(Bi(zi(r).dir),zi(r).base);return n(e.path)===n(t.path)})}function ic(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function lh(e,t){try{return t()}finally{Qg(e)}}function Dr(e,t="file"){let n=ch(e.scope);if(!n)return!1;let r=e.relativePath.split(Vi);for(let o of r.keys()){let i=Ui(e.scope.root,...r.slice(0,o+1)),s=$i(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);uh(n,Bi(i),e.scope.label)}return!0}function ch(e){if(!$i(e.root,{throwIfNoEntry:!1}))return null;if(!rh(e.root).isDirectory())throw new ae(e.label);return Bi(e.root)}function uh(e,t,n){let r=Hi(e,t);if(r===".."||r.startsWith(`..${Vi}`)||tc(r))throw new ae(n)}import{dirname as At,isAbsolute as gh,join as Tt,relative as hh,resolve as Pt,sep as yh}from"path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,sc="rulebook.json",ac=".cc-safety-net/rules";var lc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var dh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,mh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),fh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),FP=new RegExp(`^${mh}/(${wt.source.slice(1,-1)})/${fh}$`);function ph(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function cc(e){if(Lr(e))try{return Ki(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ki(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(lc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!dh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:ph(o),name:o}}function Lr(e){return lc.test(e)}var uc="rule.json",Wr="policy.json",dc=".cc-safety-net",bh="rules",Sh="CC_SAFETY_NET_HOME",mc="`cc-safety-net rule update`";function Ch(e){return Pt(e,ac)}function vh(e){return Tt(Ch(e),uc)}function Gn(e){return Tt(Pt(e),dc,Wr)}function qi(e,t={}){return t.userConfigDir??(t.userConfigPath?At(t.userConfigPath):Tt(Eh(e),bh))}function Eh(e){let t=e.env.get(Sh);return t?Pt(Se(t)):Tt(e.home,dc)}function xh(e,t={}){return Tt(qi(e,t),uc)}function en(e,t={}){return Tt(At(qi(e,t)),Wr)}function fc(e,t){let n=t.userConfigPath??xh(e,t),r=t.projectConfigPath??vh(t.cwd),o=Rh(e,t),i=_h(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Wn(o,n),projectConfigTarget:Wn(i,r)}}function Rh(e,t){let n=t.userConfigPath?At(At(Pt(t.userConfigPath))):At(Pt(t.userConfigDir??qi(e,t)));return _t(n,"user policy")}function _h(e,t){let n=Pt(t),r=Pt(e),o=hh(n,r);if(o!==".."&&!o.startsWith(`..${yh}`)&&!gh(o))return _t(n,"project policy");return _t(At(At(r)),"project policy")}function pc(e,t){return Tt(e,t,sc)}var Ce=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ut=/^[a-zA-Z][a-zA-Z0-9_-]*$/,dt=256,Y=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),gc=new Set(["python","python3","python2","node","ruby","perl"]),Gr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Fr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var hc="Rulebook exceeds CC Safety Net's safe validation limits.",yc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function bc(e){if(Yi(e.allowed_commands,Oe.maxAllowedCommands)||Yi(e.rules,Oe.maxRules)||Yi(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Yi(e,t){return Array.isArray(e)&&e.length>t}var Zi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Xi=64,Ji="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var wh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Qi=new Set(["--init-file","--rcfile"]);function es(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!wh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Qi.has(l)&&!s.includes("="))i++;continue}let a=es(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Fn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function zr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Ah(e))Fn(n,t);return t.inSingle||t.inDouble}function Ah(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Fn(s,n)}return t}var ts=new Set(["rm","find","xargs","parallel"]),Ph=new Set(["git","busybox",...ts,...Y,...gc,...we]),Th=new Set(["python","node","ruby","perl"]);function Sc(e){let t=O(e);return Ph.has(t)||Me(t)}function Me(e){return Th.has(Ih(e))}function Ih(e){let t=I(e).toLowerCase();return Gr.test(t)?"python":t}function ns(e){try{let t=Nr(kh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Dh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function kh(e){return typeof e==="string"?rc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function Cc(e){let t=new Set;return e.flatMap((n,r)=>{let o=tn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var rs=`must be one of ${Zi.join(", ")}`,Oh=/^[^/]+\/[^/]+$/,Mh=["version","rules","overrides","transparent_wrappers"];function Dh(e){let t=Nh(e);return{errors:os(Hh(t,Mh,(n)=>n.kind==="custom"),": "," "),sources:Uh(e,t)}}function Nh(e){if(!tn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Xi;return[...e.version===1?[]:[_(["version"],"must be 1")],...Lh(e.rules,t),...Fh(e.overrides),...$h(e.transparent_wrappers),...t?[]:Gh(e.rules),...tn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Oh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Bh(e.transparent_wrappers)]}function Lh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...vc(e,Xi)?[_(["rules"],Ji)]:[]];if(t)return[{path:["rules"],message:Ji,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Wh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function vc(e,t){let n=Ec(e);return n!==void 0&&!(n<=t)}function Wh(e,t){let n=Ec(e);return n!==void 0&&!(n>=t)}function Ec(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Gh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=cc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Fh(e){if(e===void 0)return[];if(!tn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!tn(n))return[_(["overrides",t],'must be "off" or an object')];return[...zh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ss(n.intent)?[]:[_(["overrides",t,"intent"],rs)]]})}function zh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...vc(e,dt)?[_(t,`must be at most ${dt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>dt?[_(t,`must be at most ${dt} characters`)]:[]}function $h(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ut.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Bh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Uh(e,t){let n=tn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Hh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function os(e,t,n){return[...new Set(e.map((r)=>{let o=is(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function is(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ss(e){return Zi.includes(e)}function tn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Rc(e){let t=Kh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var jh=`required non-empty string up to ${dt} characters`,xc="must be a non-empty array of unique non-empty strings",Vh="required non-empty array of non-empty strings";function Kh(e){if(!mt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!bc(e))return{errors:[hc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...os(qh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),yc]:t,ruleNames:new Set(_c(e).map((n)=>n.toLowerCase()))}}function _c(e){let t=mt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=mt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function qh(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Yh(e.allowed_commands),...Zh(e.rules,t),...ey(e.tests),...ty(e),...ny(e)]}function Yh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ut.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Zh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!mt(n))return[_(["rules",r],"must be an object")];return t?Jh(n,["rules",r]):Xh(n,["rules",r])}),...Cc(e)]}function Xh(e,t){return[...wc(e.name,t),...Ac(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ut.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...$r(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Pc(e.reason,t),...Tc(e.intent,t)]}function Jh(e,t){return[...wc(e.name,t),...Ac(e.command,t),...Pc(e.reason,t),...Tc(e.intent,t),...Qh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function wc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function Ac(e,t){return typeof e==="string"&&ut.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Pc(e,t){return typeof e==="string"&&e!==""&&e.length<=dt?[]:[_([...t,"reason"],jh)]}function Tc(e,t){return e===void 0||ss(e)?[]:[_([...t,"intent"],rs)]}function Qh(e,t){if(!mt(e))return[_(t,"required object")];return[...$r(e.command_path,[...t,"command_path"],Vh,!1),...e.any_args===void 0?[]:$r(e.any_args,[...t,"any_args"],xc,!0),...e.exclude_args===void 0?[]:$r(e.exclude_args,[...t,"exclude_args"],xc,!0)]}function $r(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function ey(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!mt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ty(e){if(!Array.isArray(e.tests))return[];let t=new Set(_c(e));return[...new Set(e.tests.flatMap((n)=>mt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function ny(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=mt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function mt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Nc(e,t){let n=fc(e,t),r;try{r=oc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return dy(n,f.message);throw f}let o=ns(n.userConfigTarget),i=r?{config:null,errors:[]}:ns(n.projectConfigTarget),s=Mc(n.userConfigPath,o.errors),a=Mc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Ic(o.config,Br(n.userConfigPath),"user",n.userScope,l):Dc(),u=i.config?Ic(i.config,Br(n.projectConfigPath),"project",n.projectScope,l):Dc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...kc(c.rules,m),...kc(u.rules,d)],transparent_wrappers:cy(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Oc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?uy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Oc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Ic(e,t,n,r=_t(Br(Br(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=oy(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:ry(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function ry(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function oy(e,t,n){let r=iy(e),o=pc(t,r),i=ay(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${sy(e)}`]};let s=ly(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function iy(e){return Lr(e)?Ki(e).name:e}function sy(e){return Lr(e)?`run ${mc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ay(e,t){try{return{content:Nr(Wn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function ly(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Rc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function cy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function kc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Oc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function uy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Mc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function dy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Dc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as xy,readFileSync as Ry}from"fs";var Lc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],as=new Set(Lc.map((e)=>e.id)),Ur=Lc,my=new Map(Ur.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:my.get(e)??"manual_only"}}var ls=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Hr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},fy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],py=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],cs=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...py.flatMap((e)=>fy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var jr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Wc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],gy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],us=Wc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ds=Wc.flatMap((e)=>gy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ms=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),fs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],hy=[...ls,Hr,...cs,...us,...ds,zn,...ms,...fs,...jr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Vr=new Set(jr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ps=new Set(hy.map((e)=>e.id));import{isAbsolute as gs,join as yy,normalize as by,sep as Kr}from"path";var qr=process.platform==="win32",Gc=/[*?]/;function hs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(qr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Gc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function $n(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ys(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=$n(e.trim(),t);if(!gs(n))return"must be an absolute path or start with ~/";return Bn(n,t)}function bs(e,t){let n=Fc(e,t);if(n===null)return"must be a non-empty path string";if(!gs(n))return null;if(Bn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Sy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Cy="cannot cover the guard's own configuration";function Fc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=qr?n.replaceAll("\\","/"):n;return $n(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Ss(e,t){let n=Fc(e,t);if(n===null)return"must be a non-empty path string";let r=hs(n)?.root??n;if(Gc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!gs(r))return null;if(Bn(r,t)!==null)return Sy;return vy(r,t)?Cy:null}function vy(e,t){let n=Yr(e),r=Yr(yy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Kr}`)}function Bn(e,t){let n=Yr(e),r=Yr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Kr)?n:`${n}${Kr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Yr(e){let t=by(e);if(qr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(qr?3:1)&&t.endsWith(Kr))t=t.slice(0,-1);return t}var zc=30,Zr=1,Xr=365;function $c(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Bc=new Set(Ur.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Bc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Bc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Uc(e,t){return Object.freeze(Object.fromEntries(Ur.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Hc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Uc(e,t)})}var jc={standard:0,strict:1,paranoid:2};function qc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ey(e,t)}}function Cs(e,t){return[...new Set([...e,...t??[]])]}function Ey(e,t){let n=t.safety?.level,r=Or[e.safety.level];return[...n&&jc[n]<jc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Qt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Vc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Vc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Vr.has(o))),...e.destructive_command_protection.enabled?Kc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Kc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Vc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Kc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var xs=new Set(["standard","strict","paranoid"]),Jc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:zc}};function Qc(e,t){let n=Dy(en(e,t),e.home),r=eo(Gn(t.cwd),e.home),o=wy(r.parsed,e.home),i=Object.keys(o.policy).length>0?qc(n.gui??Jc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?Es(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var _y="project policy audit settings are ignored; audit is user scope only";function wy(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...xs.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?Yc({overrides:eu(n.overrides,Qt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Qr(o.overrides,as,nu,It)}:{},...o.allow_paths!==void 0?{allow_paths:rn(o.allow_paths,ys,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Qr(i.overrides,ps,ru,It)}:{},...i.deny_paths!==void 0?{deny_paths:rn(i.deny_paths,bs,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:rn(i.allow_paths,Ss,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Yc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[_y]}}function eu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],Rs));return[]}))}function Yc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},Rs="must be a boolean",_s="must be an object if provided",tu=`must be an integer between ${Zr} and ${Xr}`,nu={path:["destructive_command_protection","overrides"],label:"destructive command"},ru={path:["secret_protection","overrides"],label:"secret protection"},Ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Py(e,t){let n=[];return{policy:ou(e,t,(o)=>{n.push(o)}),issues:n}}function Ty(e,t){return ou(e,t,It)}function ou(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Jr();if(e.version!==1)n(_(["version"],"must be 1"));let r=nn(e.safety,["safety"],["level","overrides"],n),o=nn(r.overrides,["safety","overrides"],Qt,n),i=nn(e.workflow,["workflow"],["worktree_mode"],n),s=nn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=nn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=nn(e.audit,["audit"],["retention_days"],n);return iu(e,Ay,[],n),{version:1,safety:{level:Iy(r.level,n),overrides:eu(o,Qt,["safety","overrides"],n)},workflow:{worktree_mode:vs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:vs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Qr(s.overrides,as,nu,n),allow_paths:rn(s.allow_paths,ys,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:vs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Qr(a.overrides,ps,ru,n),deny_paths:rn(a.deny_paths,bs,t,["secret_protection","deny_paths"],n),allow_paths:rn(a.allow_paths,Ss,t,["secret_protection","allow_paths"],n)},audit:{retention_days:ky(l.retention_days,n)}}}function nn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,_s)),{};return iu(e,n,t,r),e}function iu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Iy(e,t){if(e===void 0)return"standard";if(xs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function vs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,Rs));return n}function ky(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Zr&&e<=Xr))t(_(["audit","retention_days"],tu));return $c(e)}function Qr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,_s)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function rn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Jr(){return structuredClone(Jc)}function eo(e,t){if(!xy(e))return{exists:!1,policy:Jr(),errors:[]};try{let n=Ry(e,"utf-8");if(!n.trim())return{exists:!0,policy:Jr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Py(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${My(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Jr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Oy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[_s,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Rs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[tu,`not an integer between ${Zr} and ${Xr}`]]);function My(e){let t=is(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Oy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Dy(e,t){let n=eo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:Xc(),errors:[]};let o=Ty(r,t);return{policy:Es(o),gui:o,errors:[],levelPresent:Zc(r)}}if(n.parsed===void 0)return{policy:Xc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Es(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Zc(n.parsed)}}function Zc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return xs.has(t.level)}function su(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Vr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Xc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:su({}),denyPaths:[],allowPaths:[]}}}function Es(e){return{safety:Ny(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:su(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Ny(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function au(e,t){let n=Nc(e,t),r=Qc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Fy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return zy(o,Ly(n,r),s,r.policyScopes)}function Ly(e,t){let n=Gy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:$y(e.errors.length>0?Wy(e.errors):void 0,e.warnings.length>0?As(e.warnings.join("; ")):void 0,n)}}function Wy(e){return`${As(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Gy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Fy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function zy(e,t,n=Object.freeze({}),r){let o=ws(structuredClone(e)),i=r?{policyScopes:ws(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function ws(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))ws(t);return Object.freeze(e)}function $y(...e){return As(e.filter((t)=>!!t).join("; "))}function As(e){return/[.!?]$/.test(e)?e:`${e}.`}function lu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ps(t.fail_closed,e.strict,"strict"),paranoid_rm:Ps(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ps(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Hc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Li({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ps(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Un(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var By=/^[A-Za-z_][A-Za-z0-9_]*=/;function to(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Hn(e){let t=to(e.words[0],"time")?1:0,n=t===1&&to(e.words[t],"-p")?t+1:t,r=t===1&&to(e.words[n],"--")?n+1:n,o=to(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!By.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ft=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function no(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Uy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function ro(e,t,n){e.push(n),t.reset()}function oo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ts(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function on(e,t,n,r,o,i,s){return Ts({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Uy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Is(e,t,n){if(t>=n||uu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!uu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=cu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=cu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ks(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Hy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?jy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function cu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function uu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Hy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function jy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var pu=new Set(["&&","||","|","|&"]);function gu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ao(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:uo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ao(e,t,n,r,o,i,s){let a=[],l=[],c=no(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);ro(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),fu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(co(f)){if(f===`
-`||f==="\r"){m();let v=f==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!pu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=ks(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?mb(e,d,n):void 0;if(p){if(Ms(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);if(!Os(o))return sn(a,l,d,"word-limit",r.maxWords);let v=ao(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=du(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Vn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return so(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=lo(e,d);if(g){if(m(),!xu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Qy(e,d,n))&&c.start===-1){if(Ms(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);let v=f==="("?")":"}",T=ao(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=du(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Vn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return so(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?Yy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],X=A>d+h.length&&q==="#",ee=!q||co(q)||!!lo(e,A)||q===s||q===")"||X||(q==="<"||q===">")&&e[A+1]!=="(",J=h==="<<"||h==="<<-",U=J?Is(e,A,n):void 0,N=U?{word:on(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ds(e,A,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return so(a,l,N.next);if(!Os(o))return sn(a,l,N.next,"word-limit",r.maxWords)}let ue=N?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(_e),J&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Ze=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;Ze.push(...Ky(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!J&&!N)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(N)c.nested.push(...N.nested);c.end=ue,d=ue;continue}if(c.start===-1)Ms(a,l);let y=Ds(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return so(a,l,y.next);let C=nb(c.words)?ab(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(C?.limitCode)return sn(a,l,y.next,C.limitCode,C.limitCode==="word-limit"?r.maxWords:C.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=C?.words??[y.word];for(let v of E){if(!Os(o))return sn(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),fu(a,l),l.push(...fb(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function du(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:uo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ds(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||co(f)||(f===";"||f==="|"||f==="&")&&lo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=Vy(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=jn(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=Zy(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?mo(e,a,n,r,o,i):null;if(g){let h=hu(g,u,m);if(d||=h.limited,c=jn(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=Su(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=jn(c,"glob");s+=f,a++}return{word:on(e,t,a,s,c,l,c==="literal"?void 0:Jy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function Vy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
-`){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Ns(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=mo(e,m,n,r,o,i);if(f){let p=hu(f,l,c);if(m=p.next,u||=p.limited,a=jn(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=Su(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function mo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Ns(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:db(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let C=[],E=[],v=!1,T=t+u;while(T<f){let x=mo(e,T,f,r,o,i+1);if(!x){T++;continue}if(C.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:uo(E,v),issues:E,nodes:C}),next:p,provenance:"arithmetic"}}let g=ao(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Vn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:uo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function Ky(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?mo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function hu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Ns(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=ks(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=yu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=qy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Is(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function qy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=yu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function yu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!pb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function lo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Yy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function co(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function bu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Zy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Xy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Xy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return io(e,t+1,n,16,2,t+1);if(r==="u")return io(e,t+1,n,16,4,t+1);if(r==="U")return io(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return io(e,t,n,8,3,t+1);return{text:r,next:t+1}}function io(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function uo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Su(e,t,n,r,o){let i=bu(e,t,n);return{text:r+e.slice(t,i),provenance:jn(o,"variable"),next:i}}function Jy(e,t,n){let r=oo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",g=Ns(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=bu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function jn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Qy(e,t,n){return t+1>=n||co(e[t+1]??"")||lo(e,t+1)!==null}var eb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),tb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function nb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=rb(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function rb(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return ob(e,t);if(n==="env")return ib(e,t);if(n==="sudo")return sb(e,t);return}function ob(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function ib(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(eb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function sb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(tb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Cu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=vu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Eu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function ab(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=vu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Eu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>on(e,t.span.start,t.span.end,a,"literal",!1))}}function vu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>mu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=mu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...lb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function mu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&ub(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:cb(e,r)}}function lb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function cb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function ub(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Eu(e,t){let n=`x${e}`,r=Ds(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function db(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function sn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function so(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Os(e){return e.used++,e.used<=e.max}function mb(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Vn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Vn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Vn(t.body.nodes)})}function fb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function xu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function fu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!pu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ms(e,t){if(!xu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function pb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var _u=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),gb=new Set(["gc","cat","type","cp","mv","rm"]),wu=["-rec","-for","-path","-literalpath","-whatif"],hb=/^\$env:\w/i,yb=/^(?:\$\{?\w+\}?|~)\\./;function Au(e,t){let n=e.toLowerCase().replaceAll("`","");if(![..._u].some((o)=>n.includes(o))&&!(n.includes("rm")&&wu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!bb(n))return!1;let r=Fs(e,t);if(Pu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Gs(r).some(Sb)}function Pu(e){return e.nodes.some((t)=>{if(t.kind==="group")return Pu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function bb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Sb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&_u.has(n))return!0;let r=e.slice(t+1);if(n&&gb.has(n)&&r.some(Cb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return wu.some((s)=>i.startsWith(s))})}function Cb(e){return hb.test(e)||yb.test(e)}function Fs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=zs(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:_b(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function zs(e,t,n,r,o,i=!1){let s=[],a=[],l=no(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};ro(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=Rb(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(Ls(e,d,y)),d=y;continue}d++;continue}let g=ku(e,d);if(g){m(),s.push(Ls(e,d,d+g.length)),d+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Iu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=zs(e,d+1,n,r,o+1,!0),C=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,C),span:{start:d+1,end:C},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Ls(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,C=y;while(/[ \t]/.test(e[C]??""))C++;let E=C<n?Ru(e,C,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Ts({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Ru(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Ru(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let g=vb(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ws(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||ku(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:on(e,t,f,i,s,a,s==="literal"?void 0:Eb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function vb(e,t,n,r,o){let i=Tu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Iu(r.maxDepth)],nodes:[]}),next:a};let l=zs(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Tu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ws(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ws(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ws(r)}}return t}function Eb(e,t,n){let r=oo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Tu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=xb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function xb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Iu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Gs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Gs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Gs)]})}function ku(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Rb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function _b(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ls(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=ft){if(t==="powershell"||t==="auto"&&Au(e.slice(0,n.maxInputLength),n))return Fs(e,n);return gu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function an(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function fo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function $s(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Kn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){Kn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Bs(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function Qe(e,t,n){return!kt(b(e,t-1))&&j(e,t,n)&&!kt(b(e,t+n.length))}function et(e,t){return kt(b(e,t-1))!==kt(b(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function ln(e){return e==="|"||e===";"}function po(e,t,n){let r=$s(e,n);if(t==="rm")return wb(r);if(t==="dd")return Pb(r);return Wu(r,!0)}function go(e,t,n){let r=$s(e,n);if(t==="rm")return Tb(r);if(t==="reset-hard")return Nu(r,"--ha","rd");if(t==="reset-merge")return Nu(r,"--me","rge");if(t==="clean")return Mb(r);if(t==="checkout")return Nb(r);if(t==="push-force")return Lb(r);if(t==="push-refspec")return Wb(r);if(t==="push-delete")return Gb(r);if(t==="branch")return Fb(r);if(t==="tag")return Bb(r);if(t==="restore")return Ub(r);return Wu(r,!1)}function wb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(Qe(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=Ab(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Ou(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Ou(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Ab(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Ou(e,t,n){if(Mu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Mu(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Mu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function Pb(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(b(e,n))){t=!1;continue}if(Qe(e,n,"dd")){t=!0,n++;continue}if(!t||!Qe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function Tb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=b(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=kb(e,o);if(s>=0){if(Ib(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&et(e,o+11)||Us(e,o,"recursive"),r||=j(e,o,"--force")&&et(e,o+7)||Us(e,o,"force"),n&&r)return!0;o++}return!1}function Us(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&et(e,t+r+2)}function Ib(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(H(b(e,n)))n++;let i=n;while(n<Z(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Du(e,i,"recursive"),a=Du(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=Ob(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Du(e,t,n){return j(e,t,`--${n}`)&&et(e,t+n.length+2)||Us(e,t,n)}function kb(e,t){if(t>0&&kt(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function Ob(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&et(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Nu(e,t,n){return Yn(e,"reset",ln,!0,(r)=>b(e,r)==="-"&&cn(e,r,t,n)?!0:r)}function Mb(e){return Yn(e,"clean",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(cn(e,t,"--fo","rce"))return!0;let n=qn(e,t,ln);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function ho(e,t,n){if(!Qe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Z(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=qn(e,r,oe);if(Qe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=Db(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:Qe(e,r,n)?r+n.length:-1,next:qn(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=qn(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function Db(e,t,n){for(let r of Ce)if(n-t===r.length&&j(e,t,r))return!0;return!1}function Nb(e){return Lu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Lb(e){return Yn(e,"push",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!kt(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Gu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function Wb(e){return Yn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Z(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function Gb(e){return Yn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&cn(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Z(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function Fb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=ho(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=qn(e,o,oe),s=zb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function zb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(cn(e,i,"--de","lete"))r=!0;if(cn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&$b(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!et(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function $b(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Bb(e){return Lu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Lu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=ho(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(cn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&et(e,r+1))return!0;if(ln(o))i.outerActive=!1}return!1}function Yn(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=ho(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Ub(e){let t=!1;for(let n=0;n<Z(e);n++){if(Bs(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=ho(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Wu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=b(e,r),i=t?Bs(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&Qe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Qe(e,r,"find"))n=!0,r+=3}return!1}function qn(e,t,n){let r=t;while(r<Z(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Gu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return et(e,o)?o:-1}function cn(e,t,n,r){return Gu(e,t,n,r)>=0}function Ae(e,t){Kn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&go(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Hb=/^[A-Za-z_][A-Za-z0-9_]*=/;function zu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Kn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return $u(t.nodes,r,i)}function $u(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return $u(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return jb(r,t,n)})}function jb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Hb.test(o.text));return e.words.every((o,i)=>o===t||Fu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Fu(o.target.raw,n.anchored,!0)))}function Fu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Vb,resolve as Bu}from"path";function Zn(e,t,n,r){let o=Vb(e)?Bu(e):t?Bu(t,e):void 0;if(!o)return;try{return z(o,n,r)}catch{return o}}function Uu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var un="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Xn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",js=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Kb=new Set(["-p","--print"]),qb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Yb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Zb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Xb=new Map([["python",new Set(["m"])]]),Jb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Qb=new Set(["always","default","never"]),eS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),tS=/\\\r?\n/g,nS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Hu(e){return bo(e).code}function yo(e){return bo(e).sources}function ju(e){return nS.get(Ks(e))??[]}function bo(e){let t=Ks(e[0]??"");if(!js.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&Kb.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(oS(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(iS(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=rS(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(Jb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&eS.has(s))||t==="python"&&!Qb.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(Xb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(qb.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Yb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(Zb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function rS(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Vs(e,t){return Ks(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ks(e){let t=I(e).toLowerCase();return Gr.test(t)?"python":t}function oS(e,t){return js.get(e)?.has(t)??!1}function iS(e){return js.get(e)?.has("--eval")??!1}function Jn(e,t,n=!1){let r=lS(e,t);if(!Hs(r,t))return!1;xe(t,r);let o=aS(r);if(Hs(o,t))return!0;if(xe(t,o),!Vu.test(o))return!1;return!n||sS(r,t)}function sS(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>Vu.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:qs(o,a)}});if(i.some((s)=>Ys(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Hs(s.text,t))}function qs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Ys(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Vu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function aS(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Hs(e,t){if(po(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(po(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(po(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>go(o,r))))}function lS(e,t){return xe(t,e),e.replace(tS,"")}import{lstatSync as iC,readdirSync as sC}from"fs";import{basename as aC,isAbsolute as yd,join as lC,relative as bd}from"path";import{isAbsolute as Qu,parse as bS}from"path";import{dirname as cS,isAbsolute as uS,parse as dS,sep as mS}from"path";function pt(e,t,n){if(Je(t))throw Error("Unsupported Windows namespace path");let r=uS(t)?dS(t).root:"",o=r||e;for(let i of pS(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=cS(o);continue}let s=fS(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function fS(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${mS}${t}`}function pS(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Zs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],gS=new Set(Zs),hS=1024,Ku=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),qu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),yS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function So(e){return gS.has(e)}function Xs(e){return So(e)||Ku.has(e)||qu.has(e)||Ln(e)}function tt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Yu(e,t){let n=tt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=hS?{state:"valid",count:r}:{state:"invalid"}}function Co(e,t,n){let o=e.match(yS)?.[1];if(!o||!Xs(o))return null;let i=e.indexOf("=");return{name:o,value:`${tt(o,t,n)??""}${e.slice(i+1)}`}}function Zu(e){return Ju(e,qu)}function Xu(e){return Ju(e,Ku)}function Ju(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var td=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!td.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function vo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function nd(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!nd(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=ed(i),f=vo(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!CS(i)){let g=vS(dn(i),a,t.env)??Co(dn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(dn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=xS(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=wS(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=AS(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(ed(i)===d)break}let u=vo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:SS(u.words,o)}}function SS(e,t){return e.some((n)=>!t.has(n))}function ed(e){return e.map(w).join(" ")}function dn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function CS(e){return td.test(dn(e))}function vS(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var ES=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function xS(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(ES.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var RS=new Set(["-i","-0","--null"]),_S=new Set(["-u","--unset","-C","--chdir","-P"]);function wS(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(RS.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(_S.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Qn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Qn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Qn(e,t,n){if(t==="")return null;if(!e&&!Qu(t))return null;let r=Qu(t)?bS(t).root:n.realpath(e??"/");if(r===null)return null;try{return pt(r,t,n)}catch{return null}}function AS(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var PS=/['"\\$`{}#]/;function Eo(e,t){if(e.some((r)=>PS.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function gt(e,t,n){return xo(e,t,n).tokens}function TS(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function ht(e,t,n,r=0){let o=xo(e,t,n),i=(o.envSplitValues??[]).flatMap(TS);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return ht(s,t,n,r+1)}function xo(e,t,n,r){if(!nd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ta=Symbol("adopt-as-operand"),IS=new Set(["env","sudo","command","builtin"]),kS=new Set(["&&","||","|&","|","&",";"]),OS=new Set(["<<","<<<",">|"]),MS=new Set(["|","|&"]),DS=/[*@#?$!_-]/,NS=/^\w+(?::\w+)*/,LS=Object.freeze([]),er=Object.freeze({kind:"scope",edge:"enter"}),tr=Object.freeze({kind:"scope",edge:"exit"}),WS=Object.freeze([]),GS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),nr=new Set(["bash","sh","zsh","dash","ksh"]),FS=256,ad=new WeakMap;function ld(e,t){let n=t.status==="complete"?new Set(ea(t)):new Set,r=BS(e,n);if(zr(r))return Ro("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Ro("structural-limit",r,t);if(o.invalid)return Ro("invalid",r,t);let s=Ro("complete",r,t,o.assignmentFallbacks);return ad.set(s,Object.freeze(i)),s}function wo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of cd(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=zS(a,s,n,r),c=a.length>0&&MS.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===ta){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Ao(e){return cd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function rr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function zS(e,t,n,r){let o=rr(e)?new Map([...t.variables,...$S(e,t.variables)]):t.variables,i=gt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function $S(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function cd(e){return ad.get(e)??LS}function BS(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Ro(e,t,n,r=WS){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>US(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function US(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(qS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[_o("{"),...Mt(e.body,a),...s?[_o("}")]:[]]:[er,We("("),...Mt(e.body,a),...s?[We(")")]:[],tr]}]}let o=JS(e,r.functions);if(o){if(r.depth>=ft.maxDepth||++r.flags.expansions>FS)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...rd(e,r),_o(";"),...Mt(o,{...r,depth:r.depth+1}),_o(";")]},...od(e,t,n,r)]}return[{start:e.span.start,events:rd(e,r)},...od(e,t,n,r)]}function rd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:dd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:HS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function HS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?dd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[na(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:YS(r),targetOrder:OS.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:fd(t)}:{}}),...s===void 0?o:o.slice(1)]}function od(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[na(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ud(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?jS(t,n,r):[]]}function jS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ud(n.source.slice(r.span.end,e.span.end),n)}]}function ud(e,t){if(t.depth>=ft.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function dd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?na(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Js(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Js(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Mt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(er,...p,tr);continue}let m=u?Mt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(er,...m,tr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),er,...m,...c.raw.endsWith(")")?[We(")")]:[],tr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[er]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[tr]:[])}return l(),o}function Js(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=id(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=id(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function id(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=KS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return VS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&DS.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?NS:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function VS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Js(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function KS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function qS(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:kS.has(e)})}function _o(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function na(e){return Object.freeze({kind:"word",text:e})}function YS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function or(e){return GS.has(e)||/^python\d/.test(e)}var ZS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function md(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=ZS.get(e)?.has(n)??!1;return md(e,t.slice(r?2:1))}function Qs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Qs(e.slice(1));if(!IS.has(t))return[...e];return Qs(md(t,e.slice(1)))}function fd(e){let t=Hn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Qs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function XS(e){let t=fd(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return or(n)&&!nr.has(n)}function ea(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ea(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ea(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(XS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!eC(t))return r;return[...r,...o]})}function JS(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function yt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function QS(e){if(yt(e.words[0],"git"))return yt(e.words[1],"commit");if(!yt(e.words[0],"gh")||!yt(e.words[2],"create"))return!1;return yt(e.words[1],"pr")||yt(e.words[1],"issue")}function eC(e){return(yt(e.words[0],"cat")||yt(e.words[0],"tee")||QS(e))&&!e.words.some(sd)&&!e.redirections.some((n)=>sd(n.target))}function sd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var pd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),gd=new Set([...pd,"glob"]),tC=new Set([...gd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function ir(e){let t=nC(),n=On(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:rC(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function nt(e,t){if(!e.includes("$"))return e;return Pi(e,t)}function nC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=ld(i,a);return e.set(i,c),c},getCommandProgram:r}}function rC(e){let t=e.route.kind==="grep"?gd:e.route.kind==="glob"?tC:pd;return[...Pl(e.input,t),...e.route.kind==="patch"?kl(e.input):[]]}var oC=new Set(["-S","--suffix"]);function mn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return wo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Po(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&oC.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function Sd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Tr(e.invocation.toolName))return null;let a=e.paths.find((l)=>hd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=mn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>pC(a,l,t,n,r),isRedirectionTarget:(a,l)=>hd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Io(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ra(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?To(m,l):cC(m,l);if(n.markerFiles.some(u))return!0;return r&&oa(n).some(u)}if(ra(a,n))return!0;return r&&oa(n).some((c)=>To(c,a))}function cC(e,t){let n=bd(t,e);if(n===""||n.startsWith("..")||yd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function uC(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function dC(e,t,n,r,o){if(!n)return!1;return ra(Io(se(e,t,r,o)),n)}function hd(e,t,n,r,o,i){let s=Io(se(e,t,r,o));return i.includes(s)||vd(s,n)}function Cd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>To(i,Io(se(s,t,r,o)))))}function ra(e,t){return t.entries.includes(e)||t.directories.includes(e)||vd(e,t)}function vd(e,t){return t.hooksDirectories.some((n)=>To(e,n))}var mC=50000;function Ed(e,t){let n=[...new Set(oa(e))];if(n.some((o)=>t(aC(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=fC(o);if(!i)return!0;if(r+=i.length,r>mC)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>lC(o,s.name)))}return!1}function fC(e){try{let t=iC(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return sC(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function oa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function To(e,t){let n=bd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!yd(n)}function Io(e){return process.platform==="win32"?e.toLowerCase():e}function pC(e,t,n,r,o){if(rr(e))return null;let i=ht([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Po(i.slice(1)),a=s.sources.find((l)=>uC(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&dC(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as No,normalize as EC,parse as xC,posix as Id,resolve as Lt,sep as la}from"path";import{isAbsolute as gC,join as xd,normalize as wd,parse as hC,sep as Rd}from"path";var yC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],bC=` 	
-`;function sr(e,t){if(bt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ia(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return ia(e.get("TMPDIR")??"",t);let n=sa(e,t);if(n===void 0)return!0;return ia(n,t)}function sa(e,t){return Pd(e,t,"TMPDIR")}function ia(e,t){if(!e)return!1;if(CC(e))return!1;return fn(e,t)}function bt(e,t){let n=Pd(e,t,"IFS");return n!==void 0&&n!==""&&n!==bC}function fn(e,t){let n=ko(e,t.paths);if(n===null)return!1;return Ad(t).some((r)=>Do(n,r))}function Mo(e,t){let n=ko(e,t.paths);if(n===null)return!1;return Ad(t).some((r)=>Oo(r)===Oo(n))}var _d=new WeakMap;function Ad(e){let t=_d.get(e);if(t)return t;let n=SC(e);return _d.set(e,n),n}function SC(e){let t=yC.map((r)=>ko(r,e.paths)??wd(r)),n=ko(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&vC(n))return[...t,n];return t}function CC(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Pd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function vC(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function ko(e,t){try{let n=wd(e);if(!gC(n))return n;let r=hC(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=xd(i,o[s]??"");if(t.entryKind(a)==="missing")return xd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Do(e,t){let n=Oo(e),r=Oo(t);if(n===r)return!0;let o=r.endsWith(Rd)?r:`${r}${Rd}`;return n.startsWith(o)}function Oo(e){return process.platform==="win32"?e.toLowerCase():e}var RC=process.platform==="win32",Td=64,_C=16384;function ar(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return S(o.id,o.reason)}function lr(e){let t=Cu(e,Td,Td,_C);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:wC(e)}}function wC(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>AC(e.raw,n.span.start-e.span.start))}function AC(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??be();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:MC(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&NC(e))return{kind:"outside_anchored_cwd"};let o=!r&&Od(e,t.posixShell);if(Je(e))return{kind:"outside_anchored_cwd"};if(ca(e,r))return{kind:"root_or_home_target"};if(TC(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(IC(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(DC(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&FC(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>zC(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if($C(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(PC(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function PC(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(No(r)||r.startsWith("~"))return!1;if(ua(r))return!1;if(Md(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Lt(t.resolvedCwd,r),t.environment)}function kd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(OC(i))return!1;if(Mo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Md(r??i,s,t.environment.paths,t.budget))}function ca(e,t=!1){let n=e.trim(),r=Id.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function TC(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=No(o)?o:t.resolvedCwd?Lt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(z(i,t.environment.paths,t.budget));if(s===xC(s).root)return!0;return s===he(z(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=EC(e);if(RC){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function IC(e,t,n,r,o,i,s,a){let l=e.trim();if(ua(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&kC(l,n)}function kC(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Od(e.slice(n.length+1),t)})}function OC(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Id.normalize(`/${t[1]??""}`)==="/"}function ua(e){return e.split(/[\\/]+/).includes("..")}function MC(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=$n(o.trim(),t);if(!No(i))return[];try{let s=z(i,n,r);if(Bn(s,z(t,n,r)))return[];return[he(s)]}catch{return[]}})}function DC(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ua(r))return!1;let o=n?r:$n(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=No(o)?o:i?Lt(i,o):null;if(!s)return!1;try{let a=he(z(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(la)?l:`${l}${la}`))}catch{return!1}}function NC(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Od(e,t=!1){return e.includes("$")||e.includes("`")||LC(e)||t&&WC(e)}function LC(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function WC(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&GC(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function GC(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function FC(e,t,n,r){try{return he(z(e,n,r))===he(z(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function zC(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(z(Lt(t,e),n,r))===he(z(o,n,r))}catch{try{return he(Lt(t,e))===he(o)}catch{return!1}}}function $C(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return aa(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return aa(Lt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return aa(Lt(a,e),t,i,s)}catch{return!1}}function aa(e,t,n,r){try{return Dd(z(e,n,r),z(t,n,r))}catch{return!1}}function Md(e,t,n,r){if(!t)return!1;try{return Dd(z(t,n,r),z(e,n,r))}catch{return!0}}function Dd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${la}`)||n===r}var BC=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Nd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",UC="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ld="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Wd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",HC="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",jC="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",VC={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Wd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Ld},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:HC},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Nd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:UC},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Nd}};function Gd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return KC(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function KC(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=YC(o),s=o[i];if(!s||!BC.has(ov(s.text)))return null;let a=qC(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",jC);for(let l of a.targets)if(!Je(l.text)&&ca(ma(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Wd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ma(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",Ld);for(let l of a.targets){let c=ar(Fe(ma(l.text),n),n,r,VC);if(c)return c}return null}function qC(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(ZC(l))continue;if(s){t.push(da(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=JC(l.text);if(!c){t.push(da(l)),i=i||l.dynamic;continue}if(QC(c.name)){let u=c.value?XC(c.value,l):e[++a];if(u?.kind==="word"){t.push(da(u)),i=i||u.dynamic;continue}i=!0;continue}if(ev(c.name)){n=!0;continue}if(tv(c.name)){r=!0;continue}if(nv(c.name))o=rv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function YC(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function da(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function ZC(e){return e.kind==="word"&&e.text===","}function ma(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function XC(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function JC(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function QC(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function ev(e){return"recurse".startsWith(e)}function tv(e){return e.length>=2&&"force".startsWith(e)}function nv(e){return e==="wi"||"whatif".startsWith(e)}function rv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function ov(e){return e.toLowerCase()}var pn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Lo="Unsupported heredoc syntax",cr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Fd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var iv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),sv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),av=new Set(["-o","--output","--query","--subscription"]),lv=new Set;function zd(e){if(e==="aws")return iv;if(e==="gcloud")return sv;if(e==="az")return av;return lv}var cv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),uv=new Set;function $d(e){if(e==="git")return Ce;if(e==="docker")return cv;return uv}function rt(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!fv(n,o.command))continue;if(o.match){if(dv(n,e,o.match))return Bd(o);continue}if(!pv(n,e,o.subcommand))continue;if(hv(e,new Set(o.block_args),r))return Bd(o)}return null}function Bd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function dv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return mv(r,n.command_path,zd(e))}function mv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function fv(e,t){return e===O(t)}function pv(e,t,n){if(!n)return!0;return Ud(t,1,n,$d(e))}function Ud(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&gv(e,i,n,r))return!0;continue}return s===n}return!1}function gv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Ud(e,t+2,n,r)}function hv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var yv=new Set(["-e","--source"]),bv=new Set(["-F","-v","--assign","--field-separator"]),Hd=new Set(["-f","--file"]),Sv=new Set(["print","printf","return"]),jd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Cv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Vd(e,t,n){let r=!1;for(let o of vv(e)){let i=Ev(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",Cv):null}function pa(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&yv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(bv.has(a)||Hd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Hd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function dr(e){return pa(e).sources}function vv(e){return dr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Ev(e,t){xe(t,e);let n=e.includes("system")?ga(e,t):null,r=xv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ga(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Go(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Kd(e,i+1);continue}if(s==="/"&&qd(e,i)){i=Yd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ur(e[a-1])||ur(e[i]))continue;let l=Wo(e,i);if(e[l]!=="(")continue;l=Wo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Go(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Wo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function xv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Go(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Kd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&qd(e,i)){let f=Yd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(fa(e,i,"print")||fa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Wo(e,m);if(fa(e,d,"getline")){o=!0;let f=wv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Pv(s,a)){o=!0;let f=_v(e,d);if(!f){r=!0,c=m,i=m;continue}if(!Rv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ur(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Wo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Rv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Go(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Av(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function _v(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Go(e,t,n)}function wv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Av(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function fa(e,t,n){return e.startsWith(n,t)&&!ur(e[t-1])&&!ur(e[t+n.length])}function Pv(e,t){return t!==null&&t>=e}function Kd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function qd(e,t){let n=Tv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ur(e[r-1]))r--;return Sv.has(e.slice(r,n+1))}function Tv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Yd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Iv=new Set(["sudo","env","command","builtin"]);function Fo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=kv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function kv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Ov(a,r);if(l)i.push(s);if(!l&&Fr.has(O(a)))break;if(o)break}return i}function Ov(e,t){let n=I(e),r=O(e);return r==="git"||n==="busybox"||Gt(e)||ts.has(n)||t.transparentWrappers.includes(n)||Y.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Gt(e){return Iv.has(e.toLowerCase())}function Ft(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return zo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*zo(e,t,n,r,o,i,s,a,l){let c=xo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Eo(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");ha(a),yield*zo(f,t,m,r,o,i,s,a,l);return}if(Gt(u[0]??""))throw new D("wrapperPeelIterations");let d=Fo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])ha(a),yield*zo(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Dv(u)){ha(a),yield*zo(u.slice(1),t,m,r,o,i,s,a,l);return}yield Mv(u,m,r,o,i,l)}function Mv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ha(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Dv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ya(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ba(r,"recursive")){t=!0;continue}if(r==="-f"||ba(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function $o(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ba(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ba(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Nv=["--init-file","--rcfile"],Lv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Be(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Zd(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Zd(e,t,!1);if(r!==null)return r}}return null}function ot(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Zd(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Xd(e){let t=I(e[0]??"").toLowerCase(),n=Wv(e,t),r=Lv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Wv(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Nv.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Qi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=es(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Gv="find -delete permanently removes files. Use -print first to preview.",Fv="find -exec rm -rf is dangerous. Use explicit file list instead.",zv=new Set(["-exec","-execdir","-ok","-okdir"]),$v=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Jd(e,t){let n=e.map(w),r=Bv(e,n,t);if(r)return r;if(Bo(n,1)&&!qv(e,n,t)){let s=P(S("find.delete",Gv),t.policy);if(s)return s}let o=t.budget??be(),i=0;while(i<n.length){let s=n[i],a=it(s??"");if(a>0){i+=a+1;continue}if(!Ke(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=gn(n,i);i=l.nextIndex;let c=Zv(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function Bv(e,t,n){if(!Bo(t,1)&&!Sa(t,n.environment))return null;let o=mr(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=lr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!Uv(e,i.protectedGitMetadata,n.environment))return S("find.delete-git-metadata",Te)}}if(Kv(t)&&i.resolvedCwd&&Cd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function Uv(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=mr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(Ke(l)){let c=gn(r,a),u=ht([...c.tokens],n);if($o(u))return!1;if(Y.has(I(u[0]??"").toLowerCase()))return!1;if(c.tokens.some((d)=>d!=="{}"&&d.includes("{}")))return!1;if((l==="-execdir"||l==="-okdir")&&u.slice(1).some((d)=>d!=="{}"&&!d.startsWith("-")))return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(c?.provenance!=="literal"||/[[\\]/.test(c.text))return!1;if(!i)o.push(jv(c.text,l==="-iname"));a+=2;continue}if(!Hv.has(l))return!1;a+=1+it(l)}return o.length>0&&!Ed(t,(l)=>o.every((c)=>c.test(l)))}var Hv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function jv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var Vv=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Sa(e,t){let n=0;while(n<e.length){if(!Ke(e[n])){n++;continue}let r=gn(e,n),o=ht([...r.tokens],t),i=I(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir"||Y.has(i)&&Vv.test((Be(o)??"").replace(/["'\\]/g,"")))&&o.some((a)=>a.includes("{}")))return!0;n=r.nextIndex}return!1}function Kv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function qv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=mr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=sa(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!sr(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??bt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=lr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>kd(m,l,{containmentTarget:Yv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function Yv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function mr(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Zv(e,t){let n=gt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&$e(n))return S("find.exec-rm-recursive-force",Fv);return null}function gn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Bo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Ke(r)){n=gn(e,n).nextIndex;continue}let o=it(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function it(e){return $v.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Ke(e){return e!==void 0&&zv.has(e)}import{resolve as Ex}from"path";function fr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Xv=5,Ca="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function em(e,t,n){let r=Uo(e,t,n),o=Jv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Xv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=rE(m);if(d===null||d.length===0)return{blockedReason:Ca,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:Ca,expanded:!0,tokens:i}}function tm(e,t,n){return Uo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ce.has(o)?2:1}return{subcommand:null,rest:[]}}function Jv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Uo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=eE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Qv(e,t,n)]}}function Qv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=va(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=va(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Qd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Qd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ce.has(i)){o+=2;continue}o++}return r}function eE(e,t){let n=tE(e,t),r=nE(e,t);return{blockedReason:n===null||r===null?Ca:null,entries:[...n??[],...r??[]]}}function tE(e,t){let n=tt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=fr(n);if(!o)return null;for(let i of o){let s=va(i);if(!s)return null;r.push(s)}return r}function nE(e,t){let n=Yu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=tt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=tt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function va(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Qd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:tt(e.slice(r+1),t,n)}}function rE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return fr(t)}var oE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",iE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",sE="git checkout --force discards uncommitted changes. Use 'git stash' first.",aE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",lE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",cE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",uE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",dE="git switch --force discards uncommitted changes. Use 'git stash' first.",mE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",fE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",pE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",gE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",hE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",yE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",bE="git push --force destroys remote history. Use --force-with-lease for safer force push.",SE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",CE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",vE="git branch -D force-deletes without merge check. Use -d for safe delete.",EE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",xE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",RE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",_E="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",wE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",AE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",PE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",TE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),IE=new Set(["--recurse-submodules","--track","-t"]),Ea=new Set(["-b","-B","-U"]),xa=new Set(["-c","-C"]),kE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var hn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function rm(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return St(OE(r,t));case"switch":return St(DE(r));case"restore":return St(LE(r));case"reset":return GE(r);case"clean":return St(zE(r));case"rm":return St($E(r));case"push":return zt(BE(r));case"branch":return zt(jE(r));case"stash":return zt(ZE(r));case"worktree":return zt(XE(r));case"rebase":return St(VE(r));case"merge":return St(KE(r));case"tag":return zt(qE(r));case"reflog":return zt(YE(r));default:return null}}function St(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function OE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:Ea});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return S("git.checkout-force",sE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",lE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return S("git.checkout-ref-path",aE);return S("git.checkout-double-dash",oE)}let i=NE(e);if(i.length>=2)return S("git.checkout-ambiguous",cE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(ME(s)||t(s))return S("git.checkout-double-dash",iE);return null}function ME(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function DE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",uE);let n=me(t,{shortOptsWithValue:xa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",dE);return null}function NE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(TE.has(r)){n+=2;continue}if(IE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function LE(e){let t=WE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",fE):S("git.restore-unstaged",mE)}function WE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(kE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function GE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",pE);break}if(M(n,"--merge")){t=S("git.reset-merge",gE);break}}if(!t)return null;return FE(e)?zt(t):St(t)}function FE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function zE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",hE);return null}function $E(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",yE):null}function BE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",CE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||nm(t,n).some(UE))return S("git.push-force",bE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||nm(t,n).some(HE))return S("git.push-delete",SE);return null}function nm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function UE(e){return e.startsWith("+")||e.includes(":+")}function HE(e){return e.length>1&&e.startsWith(":")}function jE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",vE);return null}function VE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",EE):null}function KE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",xE):null}function qE(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",RE):null}function YE(e){return e[0]==="delete"?S("git.reflog-delete",_E):null}function ZE(e){for(let t of e){if(t==="drop")return S("git.stash-drop",wE);if(t==="clear")return S("git.stash-clear",AE)}return null}function XE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",PE);return null}import{dirname as yx,isAbsolute as bx,join as bm,resolve as Sx}from"path";var _a="TMPDIR",wa="IFS",im=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,sm=/^[A-Za-z_][A-Za-z0-9_]*$/,am=new Set(["export","typeset","declare","readonly"]),JE=new Set(["builtin","command","time"]),lm=new Set(["do","then","else"]),QE=new Set(["do","then","case"]),om=new Set(["done","fi","esac"]),ex=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function cm(e,t){return e.map((n)=>n.provenance==="variable"&&gm(n.text)?pr(n.text,t.shellAssignments):w(n))}function pr(e,t){return e.replace(ex,(n,r,o)=>t.get(r??o??"")??n)}function um(e,t){return{env:e,effectiveEnvAssignments:ox(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function dm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Aa(e,t){let n=fm(e,t),r=e[0]??"";if(QE.has(r))t.bodyDepth+=1;if(r==="elif"||om.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(om.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Pa(t,a)});let o=n.commandIndex;if(o!==-1&&am.has(e[o]??""))e.filter((a)=>sm.test(a)&&Ra(a)).forEach((a)=>{ix(t,a)});let i=o===-1?-1:pm(e,o);if(i===-1||e[i]!=="unset")return;let s=ax(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(lm.has(r)){t.shellAssignments.set(a,"");return}sx(t,a)})}function mm(e,t){let n=fm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function fm(e,t){let n=lm.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!gm(a)),o=r!==-1&&am.has(e[pm(e,r)]??""),i=rx(t);return{assignments:e.flatMap((a,l)=>{let c=tx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!So(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function pm(e,t){let n=t;while(JE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function gm(e){return Pe(e)!==null||im.test(e)}function tx(e,t,n){return Pe(e)??nx(e,t,n)}function nx(e,t,n){let r=Co(e,n,t);if(r)return r;let o=e.match(im)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ra(e){return e===_a||e===wa||Xs(e)}function rx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function ox(e,t){let n=[_a,wa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Pa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function ix(e,t){Pa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function sx(e,t){if(!Ra(t)&&!sm.test(t))return;if(e.shellAssignments.set(t,""),So(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ra(t)||t===_a||t===wa||Ln(t)){Pa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function ax(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as lx}from"path";function Ho(e,t){return Zs.some((n)=>t?.has(n)||e.has(n))}function yn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(lx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=hm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=hm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ce.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function hm(e,t,n){try{let r=pt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function ym(e,t,n){if(!t.localDiscard||!n.worktreeMode||Ho(n.environment.env,n.envAssignments))return null;let r=yn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Ta(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Ta(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||cx(o)||px(e,t.environment.env,t.envAssignments,n)||mx(o)||ux(i,o))return!0;return i==="clean"&&fx(o)>1}function cx(e){return e.some((t)=>/[$*?[]/.test(t))}function ux(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Ea}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:xa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||dx(s))||r.has("-C");return o&&i}return!1}function dx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function mx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function fx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function px(e,t,n,r){if(tt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Uo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>hx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||gx(s.value);if(Xu(n))return!0;return r.recursiveSubmodules}function gx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function hx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Sm(e,t,n){let r=e.map(w),o=n.environment.paths,i=yn(r,n.cwd,o),s=n.originalCwd?o.realpath(Sx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Ho(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?vx(e,n.shellAssignments,o):Cm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Cx(a,r,t,n)||!fn(a,n.environment)||Mo(a,n.environment)||Do(s,a)||Do(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Cx(e,t,n,r){let o=r.environment.paths,i=bm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Ta(t,r,s)}function vx(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?pr(a,t??new Map):a;if(!bx(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Cm(e,t){if(t.entryKind(bm(e,".git"))!=="missing")return e;let n=yx(e);return n===e?null:Cm(n,t)}var xx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Rx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function jo(e,t){return vm(e,t)}function vm(e,t,n){let r=e.map(w),o=em(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(S("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Zu(t.envAssignments)||tm(r,t.environment.env,t.envAssignments))&&_x(s))return S("git.ssh-env",xx);let a=rm(s,(c)=>{let u=yn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(Ex(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=ym(r,a,t)??Sm(e,a,t);if(!l)return a;return n?.(l),null}function Em(e,t){let n=null;return{match:vm(e,t,(o)=>{n=o}),relaxation:n}}function _x(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(Rx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&wx(n)}function wx(e){return e.find((t)=>!Ax(t))?.toLowerCase()==="update"}function Ax(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as nR}from"path";function xm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Vo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Rm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Px="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Tx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",wm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Ix="rm -rf in home directory is dangerous. Change to a project directory first.",_m={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:wm},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Tx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Ix},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Rm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Px},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Rm}};function Ko(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=$e(r),i=$o(r),s=Ox(e);for(let a of s){let l=lr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ar({kind:"outside_anchored_cwd"},n,t.policy,_m),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Se(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let d=Fe(u,n,m);if(d.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",wm);if(d.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let d of kx(u,n,m)){let f=ar(d,n,t.policy,_m),p=P(f,t.policy);if(p)return p}}}return null}function kx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Ox(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},Mx=new Set(["<","<<","<<-","<<<","<&","<>"]),Pm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Dx=/^(?:[0-9]+|[@*])$/,Nx=ft.maxWords,Tm=ft.maxInputLength;function Im(e){if(!e||I(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`)}function xl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Nn(e={}){return{reason:Dn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Up={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...Up[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Rl(e){return $p({...e,redact:mt})}function _l(e){return mt(e instanceof Error?e.message:String(e))}import{types as Hp}from"util";var jp=new Set(["applypatch","patch"]),Vp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Kp=new Set(["grep","grepsearch","rg"]),qp=new Set(["find","findbyname","glob"]),Yp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Zp=new Set(["command","diff","input","patch","patchtext"]),wl=new TextEncoder,Xp=new TextDecoder,Jp=/\s/,Qp=64;class Qe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Ln=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function kl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Nr(e){return Yp.has(kl(e))}function Ai(e){let t=kl(e);if(jp.has(t))return"patch";if(Kp.has(t))return"grep";if(qp.has(t))return"glob";if(Vp.has(t))return"path";return"unknown"}function Gn(e){if(!e||typeof e!=="object")return;Gl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ol(e,t){return Ml(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ml(e,t,n,r){let o=Wl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Ml(a,t,n,r+1);return typeof a==="string"&&t.has(Dl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Dl(e){return e.replace(/-/g,"_").toLowerCase()}function Nl(e){return Ll(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(tg)}function Ll(e,t,n,r){let o=Wl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ll(a,o.array?t:Zp.has(Dl(s)),n,r+1));return n.ancestors.delete(o.object),i}function eg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Ln.maxDepth||t.nodes>Ln.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Ln.maxStringBytes||t.stringBytes>Ln.maxAggregateStringBytes)Ke()}function Wl(e,t,n){if(eg(e,t,n),!e||typeof e!=="object")return null;let r=Gl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Ln.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Gl(e){if(Hp.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Qe}function tg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=ng(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...wi(Dr(c.slice(4),!0),Dr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function ng(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Il(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Il(n[1]);if(e.startsWith("diff --git "))return rg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Tl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Tl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ug(i[1]);return[]}function rg(e){let t=og(e);if(t.length===2&&t[0]&&t[1])return wi(t[0],t[1]);let n=ig(e);return n?wi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function og(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Pt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Pt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Fl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Pt(e[n]))n++;return n===e.length?t:[]}function ig(e){let t=0;while(t<e.length&&Pt(e[t]))t++;let n=e.length;while(n>t&&Pt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Pt(e[o])){o++;continue}let i=o;while(o<n&&Pt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Qp)Ke();if(sg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function sg(e,t,n,r,o){if(_i(e,t,n,r,o))return!0;let i=Al(e,"/",t,n),s=Al(e,"/",r,o);if(i<=t||s<=r)return!1;if(_i(e,t,i,r,s))return!1;return _i(e,i+1,n,s+1,o)}function _i(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Al(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Pt(e){return e!==void 0&&Jp.test(e)}function Fl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Xp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...wl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...wl.encode(ag(s[0]??""))),o+=2}return null}function ag(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function lg(e){return Wn(dg(e))}function wi(e,t){if(e==="/dev/null")return Pl(t);if(t==="/dev/null")return Pl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Wn);let n=cg(e,t)??(e===t?zl(e):null);return[e,t,...n?[n]:[]].flatMap(Wn)}function Pl(e){let t=zl(e);return[e,...t?[t]:[]].flatMap(Wn)}function zl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function cg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Tl(e){return lg(Dr(e,!0))}function ug(e){return Wn(Dr(e,!1))}function Dr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Fl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function dg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Wn(e){return e===""||e==="/dev/null"?[]:[e]}function Il(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Mi,relative as Sg,resolve as Kl,sep as vg}from"path";import{basename as Ul,dirname as mg,isAbsolute as fg,join as pg,normalize as gg,resolve as Bl}from"path";var hg=256,Lr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Se(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function et(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ki(e,t){return Pi(e,0,t)}function Pi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ti(e,o+2),a=yg(e,o,t);if(a===null){if(Lr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=bg(l,t,n),o=a+1;continue}let i=Ti(e,o+1);if(!i){r+="$",o++;continue}r+=Ii(i,n)??`$${i}`,o+=i.length+1}return r}function yg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function bg(e,t,n){let r=e.slice(2,-1),o=Ti(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ii(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Lr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Lr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=Ii(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Pi(i.slice(s.length),t+1,n);return l?Pi(i.slice(s.length),t+1,n):""}function Ti(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ii(e,t){if(!Lr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function N(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Hl(n,i);let s=t.realpath(i);if(s!==null)return $l(n,e,s,o);let a=mg(i);if(a===i||o.length>=hg)return $l(n,e,i,o);o.push(Ul(i)),i=a}}function $l(e,t,n,r){let o=r.length===0?n:pg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Cg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Hl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Hl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ae(e,t,n,r){let o=Vl(e,t,n);if(!o)return"";return N(o,n.paths,r).replace(/\\/g,"/")}function jl(e,t,n,r,o){let i=Vl(e,t,n);if(!i)return null;if(o(Ul(i)))return N(i,n.paths,r).replace(/\\/g,"/");let s=Cg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Vl(e,t,n){let r=n.home,o=ki(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Bl(r,o.slice(2)):o,s=Se(i);return gg(fg(s)?s:Bl(t,s))}function ql(e,t,n){if(et(e))return;let r=t.flatMap((i)=>Oi(i,n));if(!r[0])return;let o=Oi(Mi(e)?e:Kl(r[0],e),n)[0];if(!o)return;return r.some((i)=>Eg(o,i))?o:void 0}function Yl(e,t,n){if(et(e))return;return Oi(Mi(e)?e:Kl(t,e),n)[0]}function Oi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Eg(e,t){let n=Sg(t,e);return n===""||n!==".."&&!n.startsWith(`..${vg}`)&&!Mi(n)}function en(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Zg,realpathSync as Xg,statSync as Jg}from"fs";import{homedir as Qg,tmpdir as eh}from"os";import{statSync as Kg}from"fs";import{join as qg}from"path";import{spawnSync as xg}from"child_process";import{existsSync as zn,lstatSync as Rg,readFileSync as Bn,realpathSync as tn,statSync as Fn}from"fs";import{dirname as Di,isAbsolute as Ni,join as nn,resolve as Wr}from"path";var _g=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],wg=5000;function Xl(e,t=Ug(),n=wg){let r=Ag(e),o=r===null?null:Pg(r);if(r===null||o===null)return null;let i=Bg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Ag(e){try{let t=tn(Wr(e));return Fn(t).isDirectory()?t:null}catch{return null}}function Pg(e){let t=zg(e);if(!t)return null;try{let n=Rg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Li(t);if(!r?.commonDir)return null;if(!kg(r.gitDir,t))return null;return Og(r.gitDir,Di(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Li(e){try{let t=Tg(e);if(!t)return null;let n=tn(Ni(t)?t:Wr(Di(e),t));if(!Fn(n).isDirectory())return null;return{gitDir:n,commonDir:Ig(n)}}catch{return null}}function Tg(e){let t=Bn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Ig(e){try{let t=Bn(nn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=tn(Ni(t)?t:Wr(e,t));return Fn(n).isDirectory()?n:null}catch{return null}}function kg(e,t){let n=Mg(e);return n===null?!1:Jl(e,n,t)}function Og(e,t){let n=Dg(e);return n===null?!0:Jl(e,n,t)}function Mg(e){let t=nn(e,"gitdir");if(!zn(t))return null;let n=Bn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Dg(e){let t=nn(e,"config.worktree");return zn(t)?Lg(t):null}function Jl(e,t,n){try{return Ng(Ni(t)?t:Wr(e,t),n)}catch{return!1}}function Ng(e,t){try{let n=Fn(e),r=Fn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Zl(tn.native(e))===Zl(tn.native(t))}function Zl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Lg(e){let t=Bn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Wg(s[1]??"")}return r}function Wg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Fg(t.slice(1,-1))}var Gg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Fg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Gg[n]??t)}function zg(e){try{return Wi(tn(e))}catch{return null}}function Wi(e){let t=e;while(!0){let n=nn(t,".git");if(zn(n))return n;let r=Di(t);if(r===t)return null;t=r}}function Bg(e,t,n,r){if($g(t))return!0;if(n===null)return!0;let o=xg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ql(o.stdout.trim())}function $g(e){return[nn(e.commonDir,"config"),nn(e.gitDir,"config.worktree")].filter((t)=>zn(t)).some((t)=>jg(t))}function Ug(){return _g.find((e)=>zn(e))??null}function $n(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!$n(t)))}function jg(e){let t;try{t=Bn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Vg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ql(c)}return r}function Vg(e){return e==="include"||e.startsWith("includeif ")}function Ql(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function ec(e,t){if(e==="")return null;let n=Ce(),r=Wi(ae(e,e,t,n)),o=r?Yg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Yg(e,t,n,r){try{let o=ae(e,t,n,r),i=Kg(e),s=i.isFile()?o:null,a=i.isFile()?Li(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[rn(ae(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[rn(e.replace(/\\/g,"/")),...l]:l)];return{entry:rn(o),markerFile:s?rn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=rn(qg(d,"hooks").replace(/\\/g,"/"));return[m,rn(ae(m,t,n,r))]}))]}}catch{return null}}function rn(e){return process.platform==="win32"?e.toLowerCase():e}var th={realpath:(e)=>{try{return Xg(e)}catch{return null}},entryKind:(e)=>{let t=Zg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Jg(e).isDirectory()}catch{return!1}}};function nc(){return nh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Se(process.env.HOME||Qg()),tmpdir:eh(),paths:th})}function nh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>tc(n,i,()=>ec(i,o)),worktreeFacts:(i)=>tc(r,i,()=>Xl(i)),...t};return o}function tc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var on=["fail_closed","paranoid_rm","paranoid_interpreters"],Gr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Fr=["standard","strict","paranoid"];function rh(e,t){if(!t)return e;return Fr.indexOf(t)>Fr.indexOf(e)?t:e}function oh(e){let t=Bi(ee.level,e);if(t===void 0||t==="")return;if(Fr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Fr.join(", ")}.`);return}function ih(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function rc(e){return ih(Bi(ee.auditScope,e))==="all"}function Fi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function zi(e={},t){let n=e.safety?.level??"standard",r=oh(t),o=rh(n,r),i=Gr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Tt(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(Tt(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(Tt(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(Tt(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Tt(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Fi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Tt(e,t){let n=typeof e==="string"?Gi(e,t):Bi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Gi(e,t){return t.get(e)}function Bi(e,t){let n=Gi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Gi(e.legacyName,t);return}import{dirname as qr}from"path";import{closeSync as sh,constants as oc,fstatSync as ah,fsyncSync as jP,lstatSync as Hi,mkdirSync as VP,openSync as lh,readdirSync as KP,readFileSync as ch,realpathSync as ji,renameSync as qP,rmdirSync as YP,statSync as uh,unlinkSync as ZP,writeFileSync as XP}from"fs";import{isAbsolute as ic,join as Vi,normalize as dh,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var mh=Symbol("PolicyFilesystemScope"),fh=Symbol("PolicyFilesystemTarget"),ph=oc.O_NOFOLLOW??0;class le extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function It(e,t){return{[mh]:!0,root:qi(e),label:t}}function sc(e,t){let n=dh(t);if(t===""||ic(t)||n===".."||n.startsWith(`..${Yi}`))throw new le(e.label);return{[fh]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function Un(e,t){return sc(e,Ki(e.root,qi(t)))}function ac(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return sc(It(r,t),Ki(r,n))}function Br(e){return cc(e.scope.label,()=>{if(!zr(e))return null;let t=lh(e.path,oc.O_RDONLY|ph);return gh(t,()=>{let n=ah(t);if(!n.isFile())throw new le(e.scope.label);let r=ch(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new le(e.scope.label);return zr(e),r})})}function lc(e,t){if(e.path===t.path)return!0;return cc(e.scope.label,()=>{if(!zr(e)||!zr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function cc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof le)throw r;throw new le(e)}}function gh(e,t){try{return t()}finally{sh(e)}}function zr(e,t="file"){let n=hh(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new le(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new le(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new le(e.scope.label);yh(n,ji(i),e.scope.label)}return!0}function hh(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!uh(e.root).isDirectory())throw new le(e.label);return ji(e.root)}function yh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||ic(r))throw new le(n)}import{dirname as Ot,isAbsolute as Eh,join as Dt,relative as xh,resolve as Mt,sep as Rh}from"path";var kt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,uc="rulebook.json",dc=".cc-safety-net/rules";var mc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var bh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ch=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Sh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),tT=new RegExp(`^${Ch}/(${kt.source.slice(1,-1)})/${Sh}$`);function vh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function fc(e){if($r(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return kt.test(e)?null:`Local rulebook sources must be bare names matching ${kt}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(mc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!bh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!kt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:vh(o),name:o}}function $r(e){return mc.test(e)}var pc="rule.json",Ur="policy.json",gc=".cc-safety-net",_h="rules",wh="CC_SAFETY_NET_HOME",hc="`cc-safety-net rule update`";function Ah(e){return Mt(e,dc)}function Ph(e){return Dt(Ah(e),pc)}function Hn(e){return Dt(Mt(e),gc,Ur)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Ot(t.userConfigPath):Dt(Th(e),_h))}function Th(e){let t=e.env.get(wh);return t?Mt(Se(t)):Dt(e.home,gc)}function Ih(e,t={}){return Dt(Xi(e,t),pc)}function sn(e,t={}){return Dt(Ot(Xi(e,t)),Ur)}function yc(e,t){let n=t.userConfigPath??Ih(e,t),r=t.projectConfigPath??Ph(t.cwd),o=kh(e,t),i=Oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Un(o,n),projectConfigTarget:Un(i,r)}}function kh(e,t){let n=t.userConfigPath?Ot(Ot(Mt(t.userConfigPath))):Ot(Mt(t.userConfigDir??Xi(e,t)));return It(n,"user policy")}function Oh(e,t){let n=Mt(t),r=Mt(e),o=xh(n,r);if(o!==".."&&!o.startsWith(`..${Rh}`)&&!Eh(o))return It(n,"project policy");return It(Ot(Ot(r)),"project policy")}function bc(e,t){return Dt(e,t,uc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ft=/^[a-zA-Z][a-zA-Z0-9_-]*$/,pt=256,q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Cc=new Set(["python","python3","python2","node","ruby","perl"]),Hr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),jr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Sc="Rulebook exceeds CC Safety Net's safe validation limits.",vc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ec(e){if(Ji(e.allowed_commands,Oe.maxAllowedCommands)||Ji(e.rules,Oe.maxRules)||Ji(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Mh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!Mh[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ee(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function jn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Vr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Dh(e))jn(n,t);return t.inSingle||t.inDouble}function Dh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);jn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Nh=new Set(["git","busybox",...os,...q,...Cc,...we]),Lh=new Set(["python","node","ruby","perl"]);function xc(e){let t=O(e);return Nh.has(t)||Me(t)}function Me(e){return Lh.has(Wh(e))}function Wh(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function is(e){try{let t=Br(Gh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Bh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof le)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Gh(e){return typeof e==="string"?ac(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function Rc(e){let t=new Set;return e.flatMap((n,r)=>{let o=an(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,Fh=/^[^/]+\/[^/]+$/,zh=["version","rules","overrides","transparent_wrappers"];function Bh(e){let t=$h(e);return{errors:as(Xh(t,zh,(n)=>n.kind==="custom"),": "," "),sources:Zh(e,t)}}function $h(e){if(!an(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[_(["version"],"must be 1")],...Uh(e.rules,t),...Vh(e.overrides),...qh(e.transparent_wrappers),...t?[]:jh(e.rules),...an(e.overrides)?Object.keys(e.overrides).filter((n)=>!Fh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Yh(e.transparent_wrappers)]}function Uh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),..._c(e,es)?[_(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function _c(e,t){let n=wc(e);return n!==void 0&&!(n<=t)}function Hh(e,t){let n=wc(e);return n!==void 0&&!(n>=t)}function wc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function jh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=fc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Vh(e){if(e===void 0)return[];if(!an(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!an(n))return[_(["overrides",t],'must be "off" or an object')];return[...Kh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[_(["overrides",t,"intent"],ss)]]})}function Kh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),..._c(e,pt)?[_(t,`must be at most ${pt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>pt?[_(t,`must be at most ${pt} characters`)]:[]}function qh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ft.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(xc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Zh(e,t){let n=an(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function an(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Pc(e){let t=ey(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Jh=`required non-empty string up to ${pt} characters`,Ac="must be a non-empty array of unique non-empty strings",Qh="required non-empty array of non-empty strings";function ey(e){if(!gt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ec(e))return{errors:[Sc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(ty(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),vc]:t,ruleNames:new Set(Tc(e).map((n)=>n.toLowerCase()))}}function Tc(e){let t=gt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=gt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ty(e,t){return[...typeof e.name==="string"&&kt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...ny(e.allowed_commands),...ry(e.rules,t),...ay(e.tests),...ly(e),...cy(e)]}function ny(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ft.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function ry(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!gt(n))return[_(["rules",r],"must be an object")];return t?iy(n,["rules",r]):oy(n,["rules",r])}),...Rc(e)]}function oy(e,t){return[...Ic(e.name,t),...kc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ft.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Kr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Oc(e.reason,t),...Mc(e.intent,t)]}function iy(e,t){return[...Ic(e.name,t),...kc(e.command,t),...Oc(e.reason,t),...Mc(e.intent,t),...sy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Ic(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return kt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function kc(e,t){return typeof e==="string"&&ft.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Oc(e,t){return typeof e==="string"&&e!==""&&e.length<=pt?[]:[_([...t,"reason"],Jh)]}function Mc(e,t){return e===void 0||cs(e)?[]:[_([...t,"intent"],ss)]}function sy(e,t){if(!gt(e))return[_(t,"required object")];return[...Kr(e.command_path,[...t,"command_path"],Qh,!1),...e.any_args===void 0?[]:Kr(e.any_args,[...t,"any_args"],Ac,!0),...e.exclude_args===void 0?[]:Kr(e.exclude_args,[...t,"exclude_args"],Ac,!0)]}function Kr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function ay(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!gt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ly(e){if(!Array.isArray(e.tests))return[];let t=new Set(Tc(e));return[...new Set(e.tests.flatMap((n)=>gt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function cy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=gt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function gt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Fc(e,t){let n=yc(e,t),r;try{r=lc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof le)return by(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Wc(n.userConfigPath,o.errors),a=Wc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Dc(o.config,qr(n.userConfigPath),"user",n.userScope,l):Gc(),d=i.config?Dc(i.config,qr(n.projectConfigPath),"project",n.projectScope,l):Gc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Nc(c.rules,m),...Nc(d.rules,u)],transparent_wrappers:hy(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Lc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?yy(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Lc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Dc(e,t,n,r=It(qr(qr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=dy(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:uy(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function uy(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function dy(e,t,n){let r=my(e),o=bc(t,r),i=py(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${fy(e)}`]};let s=gy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function my(e){return $r(e)?Zi(e).name:e}function fy(e){return $r(e)?`run ${hc} to vendor ${e}`:"create that file or remove that source from the rules config"}function py(e,t){try{return{content:Br(Un(t,e))}}catch(n){if(n instanceof le)return{error:n.message};throw n}}function gy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Pc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function hy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Nc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Lc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function yy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Wc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function by(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Gc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Iy,readFileSync as ky}from"fs";var zc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(zc.map((e)=>e.id)),Yr=zc,Cy=new Map(Yr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:Cy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Sy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],vy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...vy.flatMap((e)=>Sy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Xr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Bc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Ey=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=Bc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=Bc.flatMap((e)=>Ey.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Vn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xy=[...ds,Zr,...ms,...fs,...ps,Vn,...gs,...hs,...Xr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Jr=new Set(Xr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(xy.map((e)=>e.id));import{isAbsolute as bs,join as Ry,normalize as _y,sep as Qr}from"path";var eo=process.platform==="win32",$c=/[*?]/;function Cs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(eo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if($c.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Kn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Kn(e.trim(),t);if(!bs(n))return"must be an absolute path or start with ~/";return qn(n,t)}function vs(e,t){let n=Uc(e,t);if(n===null)return"must be a non-empty path string";if(!bs(n))return null;if(qn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var wy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ay="cannot cover the guard's own configuration";function Uc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=eo?n.replaceAll("\\","/"):n;return Kn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=Uc(e,t);if(n===null)return"must be a non-empty path string";let r=Cs(n)?.root??n;if($c.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!bs(r))return null;if(qn(r,t)!==null)return wy;return Py(r,t)?Ay:null}function Py(e,t){let n=to(e),r=to(Ry(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Qr}`)}function qn(e,t){let n=to(e),r=to(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Qr)?n:`${n}${Qr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function to(e){let t=_y(e);if(eo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(eo?3:1)&&t.endsWith(Qr))t=t.slice(0,-1);return t}var Hc=30,no=1,ro=365;function jc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Vc=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Vc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Vc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Kc(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function qc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Kc(e,t)})}var Yc={standard:0,strict:1,paranoid:2};function Jc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:xs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ty(e,t)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function Ty(e,t){let n=t.safety?.level,r=Gr[e.safety.level];return[...n&&Yc[n]<Yc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...on.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Jr.has(o))),...e.destructive_command_protection.enabled?Xc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Xc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Xc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ws=new Set(["standard","strict","paranoid"]),nu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Hc}};function ru(e,t){let n=By(sn(e,t),e.home),r=so(Hn(t.cwd),e.home),o=My(r.parsed,e.home),i=Object.keys(o.policy).length>0?Jc(n.gui??nu,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?_s(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Oy="project policy audit settings are ignored; audit is user scope only";function My(e,t){if(!xe(e))return{policy:{},diagnostics:[]};let n=xe(e.safety)?e.safety:{},r=xe(e.workflow)?e.workflow:{},o=xe(e.destructive_command_protection)?e.destructive_command_protection:{},i=xe(e.secret_protection)?e.secret_protection:{},s={...ws.has(n.level)?{level:n.level}:{},...xe(n.overrides)?Qc({overrides:ou(n.overrides,on,["safety","overrides"],Nt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:io(o.overrides,us,su,Nt)}:{},...o.allow_paths!==void 0?{allow_paths:cn(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Nt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:io(i.overrides,ys,au,Nt)}:{},...i.deny_paths!==void 0?{deny_paths:cn(i.deny_paths,vs,t,["secret_protection","deny_paths"],Nt)}:{},...i.allow_paths!==void 0?{allow_paths:cn(i.allow_paths,Es,t,["secret_protection","allow_paths"],Nt)}:{}};return{policy:Qc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Oy]}}function ou(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],As));return[]}))}function Qc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Nt=()=>{return},As="must be a boolean",Ps="must be an object if provided",iu=`must be an integer between ${no} and ${ro}`,su={path:["destructive_command_protection","overrides"],label:"destructive command"},au={path:["secret_protection","overrides"],label:"secret protection"},Dy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ny(e,t){let n=[];return{policy:lu(e,t,(o)=>{n.push(o)}),issues:n}}function Ly(e,t){return lu(e,t,Nt)}function lu(e,t,n){if(!xe(e))return n(_([],"Config must be an object")),oo();if(e.version!==1)n(_(["version"],"must be 1"));let r=ln(e.safety,["safety"],["level","overrides"],n),o=ln(r.overrides,["safety","overrides"],on,n),i=ln(e.workflow,["workflow"],["worktree_mode"],n),s=ln(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=ln(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=ln(e.audit,["audit"],["retention_days"],n);return cu(e,Dy,[],n),{version:1,safety:{level:Wy(r.level,n),overrides:ou(o,on,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:io(s.overrides,us,su,n),allow_paths:cn(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:io(a.overrides,ys,au,n),deny_paths:cn(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:cn(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Gy(l.retention_days,n)}}}function ln(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(t,Ps)),{};return cu(e,n,t,r),e}function cu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Wy(e,t){if(e===void 0)return"standard";if(ws.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,As));return n}function Gy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=no&&e<=ro))t(_(["audit","retention_days"],iu));return jc(e)}function io(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function cn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function xe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function oo(){return structuredClone(nu)}function so(e,t){if(!Iy(e))return{exists:!1,policy:oo(),errors:[]};try{let n=ky(e,"utf-8");if(!n.trim())return{exists:!0,policy:oo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Ny(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${zy(i)}`),fallback:xe(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:oo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Fy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[iu,`not an integer between ${no} and ${ro}`]]);function zy(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Fy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function By(e,t){let n=so(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!xe(r))return{policy:tu(),errors:[]};let o=Ly(r,t);return{policy:_s(o),gui:o,errors:[],levelPresent:eu(r)}}if(n.parsed===void 0)return{policy:tu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:_s(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:eu(n.parsed)}}function eu(e){let t=xe(e)&&xe(e.safety)?e.safety:{};return ws.has(t.level)}function uu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Jr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function tu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:uu({}),denyPaths:[],allowPaths:[]}}}function _s(e){return{safety:$y(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:uu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function $y(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function du(e,t){let n=Fc(e,t),r=ru(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Vy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ky(o,Uy(n,r),s,r.policyScopes)}function Uy(e,t){let n=jy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:qy(e.errors.length>0?Hy(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function Hy(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function jy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Vy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ky(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function qy(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function mu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:qc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Fi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as qR,isAbsolute as YR,join as ZR,parse as XR,resolve as JR,sep as QR}from"path";function Yn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Yy=/^[A-Za-z_][A-Za-z0-9_]*=/;function ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Zn(e){let t=ao(e.words[0],"time")?1:0,n=t===1&&ao(e.words[t],"-p")?t+1:t,r=t===1&&ao(e.words[n],"--")?n+1:n,o=ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Yy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ht=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function lo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Zy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function co(e,t,n){e.push(n),t.reset()}function uo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function un(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Zy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||pu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!pu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=fu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=fu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Xy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Jy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function fu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function pu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Xy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Jy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var bu=new Set(["&&","||","|","|&"]);function Cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=po(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:yo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function po(e,t,n,r,o,i,s){let a=[],l=[],c=lo(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);co(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),yu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(ho(f)){if(f===`
+`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
+`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!bu.has(P.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let x=Ds(e,b,n,d.splice(0));l.push(...x.issues),u=x.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let g=c.start===-1?Cb(e,u,n):void 0;if(g){if(Ls(a,l),i>=r.maxDepth)return dn(a,l,u,"depth-limit",r.maxDepth);if(!Ns(o))return dn(a,l,u,"word-limit",r.maxWords);let b=po(e,g.braceIndex+1,n,r,o,i+1,"}"),P=b.next,x={start:g.braceIndex+1,end:b.closed?P-1:P},A=gu(e,x,b);if(a.push({kind:"function",name:g.name,span:{start:u,end:P},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||Jn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...b.pendingHeredocs),b.limited)return fo(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let p=go(e,u);if(p){if(m(),!Au(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:u,end:u+p.length})})),u+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&sb(e,u,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return dn(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",P=po(e,u+1,n,r,o,i+1,b),x=P.next,A={start:u+1,end:P.closed?x-1:x},Y=gu(e,A,P);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:x},body:Y}),l.push(...P.issues),P.pendingHeredocs.length>0||Jn(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return fo(a,l,P.next);if(!P.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=x;continue}let h=(f==="<"||f===">")&&e[u+1]!=="("?nb(e,u):null;if(h){let b=c.words.at(-1),P=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(P!==void 0)c.words.pop();let x=P===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let Y=e[A],ke=A>u+h.length&&Y==="#",je=!Y||ho(Y)||!!go(e,A)||Y===s||Y===")"||ke||(Y==="<"||Y===">")&&e[A+1]!=="(",de=h==="<<"||h==="<<-",j=de?Ms(e,A,n):void 0,G=j?{word:un(e,A,j.next,j.delimiter,"literal",j.quoted),nested:[],issues:[],next:j.next,limited:!1}:!je?Ws(e,A,n,r,o,i):void 0;if(G){if(l.push(...G.issues),G.limited)return fo(a,l,G.next);if(!Ns(o))return dn(a,l,G.next,"word-limit",r.maxWords)}let J=G?.next??u+h.length,X={kind:"redirection",operator:h,span:{start:x,end:J},...P===void 0?{}:{fd:P},...G?{target:G.word}:{}};if(c.redirections.push(X),de&&!j)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(j){if(j.ambiguous||j.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;d.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:h==="<<-",attach:(be)=>{if(X.heredoc=be,be.quotedDelimiter)return;Q.push(...eb(e,be.bodySpan.start,be.bodySpan.end,r,o,i+1))}})}if(!de&&!G)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(G)c.nested.push(...G.nested);c.end=J,u=J;continue}if(c.start===-1)Ls(a,l);let y=Ws(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return fo(a,l,y.next);let v=cb(c.words)?pb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return dn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Ns(o))return dn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),yu(a,l),l.push(...Sb(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function gu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:yo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ho(f)||(f===";"||f==="|"||f==="&")&&go(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=Qy(e,a,n,r,o,i);if(s+=h.text,d.push(...h.nested),m.push(...h.issues),u||=h.limited,c=Xn(c,h.provenance),a=h.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let h=rb(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let p=f==="$"||f==="<"||f===">"||f==="`"?bo(e,a,n,r,o,i):null;if(p){let h=Su(p,d,m);if(u||=h.limited,c=Xn(c,h.provenance),a=h.next,u)break;continue}if(f==="$"){let h=xu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Xn(c,"glob");s+=f,a++}return{word:un(e,t,a,s,c,l,c==="literal"?void 0:ib(e,t,a)),nested:d,issues:m,next:a,limited:u}}function Qy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let g=e[m+1]??"";if(g===`
+`){m+=2;continue}if(g==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,m+=2;continue}if(e.startsWith("$((",m)){let g=Gs(e,m+3,n,"))"),p=g===-1?n:g+2;if(s+=e.slice(m,p),g===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=p;continue}let f=bo(e,m,n,r,o,i);if(f){let g=Su(f,l,c);if(m=g.next,d||=g.limited,a=Xn(a,g.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let g=xu(e,m,n,s,a);s=g.text,a=g.provenance,m=g.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function bo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=Gs(e,t+d,n,m),f=u===-1?n:u,g=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:bb(e,t+d,f,"depth-limit"),next:g,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,P=t+d;while(P<f){let x=bo(e,P,f,r,o,i+1);if(!x){P++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),b||=x.program.status==="limited",P=x.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo(E,b),issues:E,nodes:v}),next:g,provenance:"arithmetic"}}let p=po(e,t+d,f,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`}]:[],y=(c||l)&&Jn(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo([...p.issues,...h,...y],p.limited),issues:[...p.issues,...h,...y],nodes:p.nodes}),next:g,provenance:"command-substitution"}}function eb(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?bo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Su(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
+`?a+2:a+1,m=Ds(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=vu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=tb(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=Ms(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function tb(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=vu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function vu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!vb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function go(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function nb(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ho(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Eu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function rb(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ob(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ob(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return mo(e,t+1,n,16,2,t+1);if(r==="u")return mo(e,t+1,n,16,4,t+1);if(r==="U")return mo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return mo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function mo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function yo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function xu(e,t,n,r,o){let i=Eu(e,t,n);return{text:r+e.slice(t,i),provenance:Xn(o,"variable"),next:i}}function ib(e,t,n){let r=uo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,g=c?"))":u?"`":")",p=Gs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Eu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Xn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function sb(e,t,n){return t+1>=n||ho(e[t+1]??"")||go(e,t+1)!==null}var ab=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),lb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function cb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=ub(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function ub(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return db(e,t);if(n==="env")return mb(e,t);if(n==="sudo")return fb(e,t);return}function db(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function mb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(ab.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function fb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(lb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Ru(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=_u(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>wu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function pb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=_u(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>wu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>un(e,t.span.start,t.span.end,a,"literal",!1))}}function _u(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>hu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=hu(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let m=d.start+c.length-d.end,u=d.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...gb(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function hu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&yb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:hb(e,r)}}function gb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function hb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function yb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function wu(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function bb(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function dn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function fo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function Cb(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Jn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Jn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Jn(t.body.nodes)})}function Sb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Au(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function yu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!bu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ls(e,t){if(!Au(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function vb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Tu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Eb=new Set(["gc","cat","type","cp","mv","rm"]),Iu=["-rec","-for","-path","-literalpath","-whatif"],xb=/^\$env:\w/i,Rb=/^(?:\$\{?\w+\}?|~)\\./;function ku(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Tu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Iu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!_b(n))return!1;let r=$s(e,t);if(Ou(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(wb)}function Ou(e){return e.nodes.some((t)=>{if(t.kind==="group")return Ou(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function _b(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function wb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Tu.has(n))return!0;let r=e.slice(t+1);if(n&&Eb.has(n)&&r.some(Ab))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Iu.some((s)=>i.startsWith(s))})}function Ab(e){return xb.test(e)||Rb.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Ob(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=lo(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};co(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let g=kb(e,u,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[u+1]===`
+`?u+2:u+1;s.push(Fs(e,u,y)),u=y;continue}u++;continue}let p=Nu(e,u);if(p){m(),s.push(Fs(e,u,u+p.length)),u+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Du(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(Fs(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?Pu(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Os({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=Pu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function Pu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(g)=>{let p=Pb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),d+=zs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||Nu(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:un(e,t,f,i,s,a,s==="literal"?void 0:Tb(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function Pb(e,t,n,r,o){let i=Mu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Du(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Mu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function Tb(e,t,n){let r=uo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Mu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Ib(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ib(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Du(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function Nu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function kb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Ob(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=ht){if(t==="powershell"||t==="auto"&&ku(e.slice(0,n.maxInputLength),n))return $s(e,n);return Cu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function mn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function Co(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Qn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Re(e,t){Qn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function U(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function H(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Lt(C(e,t-1))&&H(e,t,n)&&!Lt(C(e,t+n.length))}function nt(e,t){return Lt(C(e,t-1))!==Lt(C(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function fn(e){return e==="|"||e===";"}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return Mb(r);if(t==="dd")return Nb(r);return Bu(r,!0)}function vo(e,t,n){let r=Hs(e,n);if(t==="rm")return Lb(r);if(t==="reset-hard")return Fu(r,"--ha","rd");if(t==="reset-merge")return Fu(r,"--me","rge");if(t==="clean")return zb(r);if(t==="checkout")return $b(r);if(t==="push-force")return Ub(r);if(t==="push-refspec")return Hb(r);if(t==="push-delete")return jb(r);if(t==="branch")return Vb(r);if(t==="tag")return Yb(r);if(t==="restore")return Zb(r);return Bu(r,!1)}function Mb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(tt(e,i,"rm")&&U(l)&&l!==`
+`)t=!0,i++;continue}let a=Db(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Lu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(U(s)){if(o<0)continue;if(H(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Lu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Db(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(H(e,t,String.raw`\n`))return t+2;if(H(e,t,String.raw`\x0a`)||H(e,t,String.raw`\x0A`))return t+5;if(H(e,t,String.raw`\u000a`)||H(e,t,String.raw`\u000A`))return t+7;return H(e,t,String.raw`\012`)?t+4:-1}function Lu(e,t,n){if(Wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Wu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!H(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function Nb(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(C(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!H(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!U(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Lb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=Gb(e,o);if(s>=0){if(Wb(e,s))return!0;let a=s,l=!1;while(U(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(H(e,o,"--")&&(o===0||U(C(e,o-1)))&&(!C(e,o+2)||U(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=H(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=H(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!H(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||U(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function Wb(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(U(C(e,n)))n++;let i=n;while(n<Z(e)&&!U(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&H(e,i,"--"))return!1;let s=Gu(e,i,"recursive"),a=Gu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=Fb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Gu(e,t,n){return H(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function Gb(e,t){if(t>0&&Lt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!U(C(e,n+1)))return-1;return n+1}function Fb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&nt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Fu(e,t,n){return tr(e,"reset",fn,!0,(r)=>C(e,r)==="-"&&pn(e,r,t,n)?!0:r)}function zb(e){return tr(e,"clean",fn,!0,(t)=>{if(C(e,t)!=="-")return t;if(pn(e,t,"--fo","rce"))return!0;let n=er(e,t,fn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!U(C(e,r)))return{commandEnd:-1,next:r};while(U(C(e,r)))r++;while(r<Z(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=er(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&H(e,r,"--"),s=Bb(e,r,o);r=o;while(U(C(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:er(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=er(e,r,oe);while(U(C(e,r)))r++}return{commandEnd:-1,next:r}}function Bb(e,t,n){for(let r of ve)if(n-t===r.length&&H(e,t,r))return!0;return!1}function $b(e){return zu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Ub(e){return tr(e,"push",fn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Lt(C(e,t+2))&&!H(e,t+2,"-with-lease"))return!0;let n=$u(e,t,"--fo","rce");if(n>=0&&!H(e,n,"-with-lease"))return!0;return t})}function Hb(e){return tr(e,"push",oe,!1,(t)=>{if(U(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!oe(C(e,t+2))&&!U(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function jb(e){return tr(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&pn(e,t,"--de","lete"))return!0;if(U(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!U(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function Vb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=er(e,o,oe),s=Kb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Kb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(pn(e,i,"--de","lete"))r=!0;if(pn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&qb(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function qb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Yb(e){return zu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function zu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(U(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&U(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(pn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(fn(o))i.outerActive=!1}return!1}function tr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||U(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function Zb(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(H(e,n+2,"staged")||H(e,n+2,"help")))t=!1}return t}function Bu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?js(o):oe(o);if(n&&U(o)&&C(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function er(e,t,n){let r=t;while(r<Z(e)&&!U(C(e,r))&&!n(C(e,r)))r++;return r}function $u(e,t,n,r){if(!H(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function pn(e,t,n,r){return $u(e,t,n,r)>=0}function Ae(e,t){Qn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Re(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Xb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Qn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return ju(t.nodes,r,i)}function ju(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return ju(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Jb(r,t,n)})}function Jb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Xb.test(o.text));return e.words.every((o,i)=>o===t||Uu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Uu(o.target.raw,n.anchored,!0)))}function Uu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Qb,resolve as Vu}from"path";function nr(e,t,n,r){let o=Qb(e)?Vu(e):t?Vu(t,e):void 0;if(!o)return;try{return N(o,n,r)}catch{return o}}function Ku(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var gn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",rr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),eC=new Set(["-p","--print"]),tC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),nC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),rC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),oC=new Map([["python",new Set(["m"])]]),iC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),sC=new Set(["always","default","never"]),aC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),lC=/\\\r?\n/g,cC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function qu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Yu(e){return cC.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&eC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(dC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(mC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=uC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(iC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&aC.has(s))||t==="python"&&!sC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(oC.get(t)?.has(u)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Ne(t,n,r,o)}if(tC.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(nC.get(t)?.has(u)){if(m+1===s.length)i++;break}if(rC.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function uC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function dC(e,t){return qs.get(e)?.has(t)??!1}function mC(e){return qs.get(e)?.has("--eval")??!1}function or(e,t,n=!1){let r=gC(e,t);if(!Ks(r,t))return!1;Re(t,r);let o=pC(r);if(Ks(o,t))return!0;if(Re(t,o),!Zu.test(o))return!1;return!n||fC(r,t)}function fC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+d.length,u=m;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:m,text:e.slice(m,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Zu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||d)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Zu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function pC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Re(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Re(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Re(t,e),n.some((o)=>vo(o,r))))}function gC(e,t){return Re(t,e),e.replace(lC,"")}import{lstatSync as mS,readdirSync as fS}from"fs";import{basename as pS,isAbsolute as vd,join as gS,relative as Ed}from"path";import{isAbsolute as rd,parse as _C}from"path";import{dirname as hC,isAbsolute as yC,parse as bC,sep as CC}from"path";function yt(e,t,n){if(et(t))throw Error("Unsupported Windows namespace path");let r=yC(t)?bC(t).root:"",o=r||e;for(let i of vC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=hC(o);continue}let s=SC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function SC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${CC}${t}`}function vC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],EC=new Set(Qs),xC=1024,Xu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ju=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),RC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function _o(e){return EC.has(e)}function ea(e){return _o(e)||Xu.has(e)||Ju.has(e)||$n(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Qu(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=xC?{state:"valid",count:r}:{state:"invalid"}}function wo(e,t,n){let o=e.match(RC)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function ed(e){return nd(e,Ju)}function td(e){return nd(e,Xu)}function nd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var id=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!id.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function sd(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!sd(hn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let u=od(i),f=Ao(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&hn(i).includes("=")&&!AC(i)){let p=PC(hn(i),a,t.env)??wo(hn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(hn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=IC(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=MC(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=DC(i);if(g==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(od(i)===u)break}let d=Ao(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:wC(d.words,o)}}function wC(e,t){return e.some((n)=>!t.has(n))}function od(e){return e.map(w).join(" ")}function hn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function AC(e){return id.test(hn(e))}function PC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var TC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function IC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?ir(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ir(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ir(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(TC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var kC=new Set(["-i","-0","--null"]),OC=new Set(["-u","--unset","-C","--chdir","-P"]);function MC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(kC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(OC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?ir(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ir(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function ir(e,t,n){if(t==="")return null;if(!e&&!rd(t))return null;let r=rd(t)?_C(t).root:n.realpath(e??"/");if(r===null)return null;try{return yt(r,t,n)}catch{return null}}function DC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var NC=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>NC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function bt(e,t,n){return To(e,t,n).tokens}function LC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(LC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!sd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),WC=new Set(["env","sudo","command","builtin"]),GC=new Set(["&&","||","|&","|","&",";"]),FC=new Set(["<<","<<<",">|"]),zC=new Set(["|","|&"]),BC=/[*@#?$!_-]/,$C=/^\w+(?::\w+)*/,UC=Object.freeze([]),sr=Object.freeze({kind:"scope",edge:"enter"}),ar=Object.freeze({kind:"scope",edge:"exit"}),HC=Object.freeze([]),jC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),lr=new Set(["bash","sh","zsh","dash","ksh"]),VC=256,dd=new WeakMap;function md(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=YC(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Gt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return dd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of fd(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=KC(a,s,n,r),c=a.length>0&&zC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===oa){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return fd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function cr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function KC(e,t,n,r){let o=cr(e)?new Map([...t.variables,...qC(e,t.variables)]):t.variables,i=bt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ae(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function qC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function fd(e){return dd.get(e)??UC}function YC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=HC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Gt(e,t){return e.nodes.flatMap((n,r)=>ZC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function ZC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(tS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Gt(e.body,a),...s?[ko("}")]:[]]:[sr,We("("),...Gt(e.body,a),...s?[We(")")]:[],ar]}]}let o=iS(e,r.functions);if(o){if(r.depth>=ht.maxDepth||++r.flags.expansions>VC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ad(e,r),ko(";"),...Gt(o,{...r,depth:r.depth+1}),ko(";")]},...ld(e,t,n,r)]}return[{start:e.span.start,events:ad(e,r)},...ld(e,t,n,r)]}function ad(e,t){return[...e.words.map((n)=>({start:n.span.start,events:gd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:XC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function XC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?gd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:nS(r),targetOrder:FC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:yd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ld(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...pd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?JC(t,n,r):[]]}function JC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:pd(n.source.slice(r.span.end,e.span.end),n)}]}function pd(e,t){if(t.depth>=ht.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Gt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function gd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=d?Gt(d,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(sr,...g,ar);continue}let m=d?Gt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(sr,...m,ar);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),sr,...m,...c.raw.endsWith(")")?[We(")")]:[],ar);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[sr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[ar]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=cd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=cd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function cd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=eS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return QC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&BC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?$C:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function QC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function eS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function tS(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:GC.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function nS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function ur(e){return jC.has(e)||/^python\d/.test(e)}var rS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function hd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=rS.get(e)?.has(n)??!1;return hd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!WC.has(t))return[...e];return na(hd(t,e.slice(1)))}function yd(e){let t=Zn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function oS(e){let t=yd(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return ur(n)&&!lr.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(oS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!aS(t))return r;return[...r,...o]})}function iS(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function St(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function sS(e){if(St(e.words[0],"git"))return St(e.words[1],"commit");if(!St(e.words[0],"gh")||!St(e.words[2],"create"))return!1;return St(e.words[1],"pr")||St(e.words[1],"issue")}function aS(e){return(St(e.words[0],"cat")||St(e.words[0],"tee")||sS(e))&&!e.words.some(ud)&&!e.redirections.some((n)=>ud(n.target))}function ud(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var bd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Cd=new Set([...bd,"glob"]),lS=new Set([...Cd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function dr(e){let t=cS(),n=Gn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:uS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function cS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=md(i,a);return e.set(i,c),c},getCommandProgram:r}}function uS(e){let t=e.route.kind==="grep"?Cd:e.route.kind==="glob"?lS:bd;return[...Ol(e.input,t),...e.route.kind==="patch"?Nl(e.input):[]]}var dS=new Set(["-S","--suffix"]);function yn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&dS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function xd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Nr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Sd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=yn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>vS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Sd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Ft(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(ae(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?No(m,l):hS(m,l);if(n.markerFiles.some(d))return!0;return r&&aa(n).some(d)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function hS(e,t){let n=Ed(t,e);if(n===""||n.startsWith("..")||vd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function yS(e,t,n,r,o){return Ft(e,t,n,!0,r,o)}function bS(e,t,n,r,o){if(!n)return!1;return sa(Lo(ae(e,t,r,o)),n)}function Sd(e,t,n,r,o,i){let s=Lo(ae(e,t,r,o));return i.includes(s)||_d(s,n)}function Rd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(ae(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||_d(e,t)}function _d(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var CS=50000;function wd(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(pS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=SS(o);if(!i)return!0;if(r+=i.length,r>CS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>gS(o,s.name)))}return!1}function SS(e){try{let t=mS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return fS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=Ed(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!vd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function vS(e,t,n,r,o){if(cr(e))return null;let i=Ct([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>yS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&bS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as TS,parse as IS,posix as Dd,resolve as Bt,sep as da}from"path";import{isAbsolute as ES,join as Ad,normalize as Id,parse as xS,sep as Pd}from"path";var RS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],_S=` 	
+`;function mr(e,t){if(vt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Od(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(AS(e))return!1;return bn(e,t)}function vt(e,t){let n=Od(e,t,"IFS");return n!==void 0&&n!==""&&n!==_S}function bn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return kd(t).some((r)=>Cn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return kd(t).some((r)=>Go(r)===Go(n))}var Td=new WeakMap;function kd(e){let t=Td.get(e);if(t)return t;let n=wS(e);return Td.set(e,n),n}function wS(e){let t=RS.map((r)=>Wo(r,e.paths)??Id(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&PS(n))return[...t,n];return t}function AS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Od(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function PS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Id(e);if(!ES(n))return n;let r=xS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Ad(i,o[s]??"");if(t.entryKind(a)==="missing")return Ad(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Cn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Pd)?r:`${r}${Pd}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var kS=process.platform==="win32",Md=64,OS=16384;function fr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return S(o.id,o.reason)}function pr(e){let t=Ru(e,Md,Md,OS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:MS(e)}}function MS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>DS(e.raw,n.span.start-e.span.start))}function DS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Et(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:zS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&$S(e))return{kind:"outside_anchored_cwd"};let o=!r&&Ld(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(LS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ft(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(WS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(BS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&VS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>KS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(qS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(NS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function NS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Wd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return bn(Bt(t.resolvedCwd,r),t.environment)}function Nd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(FS(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Wd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Dd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function LS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?Bt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(N(i,t.environment.paths,t.budget));if(s===IS(s).root)return!0;return s===he(N(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=TS(e);if(kS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function WS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&bn(l,a))return!0;return(t||i&&s)&&n&&!o&&GS(l,n)}function GS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Ld(e.slice(n.length+1),t)})}function FS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Dd.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function zS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Kn(o.trim(),t);if(!zo(i))return[];try{let s=N(i,n,r);if(qn(s,N(t,n,r)))return[];return[he(s)]}catch{return[]}})}function BS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Kn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?Bt(i,o):null;if(!s)return!1;try{let a=he(N(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function $S(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Ld(e,t=!1){return e.includes("$")||e.includes("`")||US(e)||t&&HS(e)}function US(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function HS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&jS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function jS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function VS(e,t,n,r){try{return he(N(e,n,r))===he(N(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function KS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(N(Bt(t,e),n,r))===he(N(o,n,r))}catch{try{return he(Bt(t,e))===he(o)}catch{return!1}}}function qS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua(Bt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua(Bt(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Gd(N(e,n,r),N(t,n,r))}catch{return!1}}function Wd(e,t,n,r){if(!t)return!1;try{return Gd(N(t,n,r),N(e,n,r))}catch{return!0}}function Gd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var YS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Fd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",zd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Bd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",XS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",JS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",QS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Bd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:zd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:XS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Fd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:ZS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Fd}};function $d(e,t,n,r=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return ev(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function ev(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=nv(o),s=o[i];if(!s||!YS.has(dv(s.text)))return null;let a=tv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",JS);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Bd);for(let l of a.targets)if(n.resolvedCwd&&Ft(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",zd);for(let l of a.targets){let c=fr(Fe(ga(l.text),n),n,r,QS);if(c)return c}return null}function tv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(rv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=iv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(sv(c.name)){let d=c.value?ov(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(av(c.name)){n=!0;continue}if(lv(c.name)){r=!0;continue}if(cv(c.name))o=uv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function nv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function rv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function ov(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function iv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function sv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function av(e){return"recurse".startsWith(e)}function lv(e){return e.length>=2&&"force".startsWith(e)}function cv(e){return e==="wi"||"whatif".startsWith(e)}function uv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function dv(e){return e.toLowerCase()}var Sn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",gr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Ud="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),fv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),pv=new Set(["-o","--output","--query","--subscription"]),gv=new Set;function Hd(e){if(e==="aws")return mv;if(e==="gcloud")return fv;if(e==="az")return pv;return gv}var hv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),yv=new Set;function jd(e){if(e==="git")return ve;if(e==="docker")return hv;return yv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!Sv(n,o.command))continue;if(o.match){if(bv(n,e,o.match))return Vd(o);continue}if(!vv(n,e,o.subcommand))continue;if(xv(e,new Set(o.block_args),r))return Vd(o)}return null}function Vd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function bv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Cv(r,n.command_path,Hd(e))}function Cv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Sv(e,t){return e===O(t)}function vv(e,t,n){if(!n)return!0;return Kd(t,1,n,jd(e))}function Kd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Ev(e,i,n,r))return!0;continue}return s===n}return!1}function Ev(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Kd(e,t+2,n,r)}function xv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Rv=new Set(["-e","--source"]),_v=new Set(["-F","-v","--assign","--field-separator"]),qd=new Set(["-f","--file"]),wv=new Set(["print","printf","return"]),Yd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Av="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Zd(e,t,n){let r=!1;for(let o of Pv(e)){let i=Tv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",Av):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Rv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(_v.has(a)||qd.has(a))){let l=e[s+1];if(i&&=l!==void 0,qd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function yr(e){return ya(e).sources}function Pv(e){return yr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Tv(e,t){Re(t,e);let n=e.includes("system")?ba(e,t):null,r=Iv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ba(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Xd(e,i+1);continue}if(s==="/"&&Jd(e,i)){i=Qd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,hr(e[a-1])||hr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Iv(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Xd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Jd(e,i)){let f=Qd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=$o(e,m);if(ha(e,u,"getline")){o=!0;let f=Mv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Nv(s,a)){o=!0;let f=Ov(e,u);if(!f){r=!0,c=m,i=m;continue}if(!kv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function hr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function kv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Dv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Ov(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Mv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Dv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!hr(e[t-1])&&!hr(e[t+n.length])}function Nv(e,t){return t!==null&&t>=e}function Xd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Jd(e,t){let n=Lv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(hr(e[r-1]))r--;return wv.has(e.slice(r,n+1))}function Lv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Qd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Wv=new Set(["sudo","env","command","builtin"]);function Ho(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=Gv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Gv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Fv(a,r);if(l)i.push(s);if(!l&&jr.has(O(a)))break;if(o)break}return i}function Fv(e,t){let n=I(e),r=O(e);return r==="git"||n==="busybox"||$t(e)||os.has(n)||t.transparentWrappers.includes(n)||q.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return Wv.has(e.toLowerCase())}function Ut(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return jo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*jo(e,t,n,r,o,i,s,a,l){let c=To(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=Po(c.envSplitValues,d);if(!f)throw new D("derivedCommandShape");Ca(a),yield*jo(f,t,m,r,o,i,s,a,l);return}if($t(d[0]??""))throw new D("wrapperPeelIterations");let u=Ho(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])Ca(a),yield*jo(f===u.childIndex?u.tokens:d.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Bv(d)){Ca(a),yield*jo(d.slice(1),t,m,r,o,i,s,a,l);return}yield zv(d,m,r,o,i,l)}function zv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ca(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Bv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var $v=["--init-file","--rcfile"],Uv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function $e(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return em(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=em(e,t,!1);if(r!==null)return r}}return null}function st(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ee(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function em(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function tm(e){let t=I(e[0]??"").toLowerCase(),n=Hv(e,t),r=Uv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Hv(e,t){let n=Ee(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?$v.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var jv="find -delete permanently removes files. Use -print first to preview.",Vv="find -exec rm -rf is dangerous. Use explicit file list instead.",Kv=new Set(["-exec","-execdir","-ok","-okdir"]),qv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function nm(e,t){let n=e.map(w),r=Yv(e,n,t);if(r)return r;if(Ko(n,1)&&!tE(e,n,t)){let s=T(S("find.delete",jv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=at(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=vn(n,i);i=l.nextIndex;let c=rE(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:T(m,t.policy);if(u)return u}return null}function Yv(e,t,n){if(!Ko(t,1)&&!Ea(t,n.environment))return null;let o=br(e)??K(["."]),i=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=pr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!Zv(e,i.protectedGitMetadata,n.environment))return S("find.delete-git-metadata",Te)}}if(eE(t)&&i.resolvedCwd&&Rd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function Zv(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=br(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=vn(r,a),d=Ct([...c.tokens],n),m=Vo(d),u=q.has(I(d[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||u||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(Jv(c.text,l==="-iname"));a+=2;continue}if(!Xv.has(l))return!1;a+=1+at(l)}return o.length>0&&!wd(t,(l)=>o.every((c)=>c.test(l)))}var Xv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function Jv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var Qv=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=vn(e,n),o=Ct([...r.tokens],t),i=I(o[0]??"").toLowerCase(),s=q.has(i)&&Qv.test(($e(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function eE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function tE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=br(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!mr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??vt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Et(l),d=Et({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&u&&!Cn(u,m)?n.cwd:void 0;return r.every((g)=>{let p=pr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[w(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,v=y??h;return Nd(v,y?d:c,{containmentTarget:nE(v,i),targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected})})})}function nE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function br(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function rE(e,t){let n=bt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&Be(n))return S("find.exec-rm-recursive-force",Vv);return null}function vn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ko(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=vn(e,n).nextIndex;continue}let o=at(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function at(e){return qv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&Kv.has(e)}import{resolve as Tx}from"path";function Cr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var oE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function om(e,t,n){let r=qo(e,t,n),o=iE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<oE;a++){let{subcommand:l,rest:c}=_e(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=uE(m);if(u===null||u.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function im(e,t,n){return qo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function _e(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function iE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=aE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...sE(e,t,n)]}}function sE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=rm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=rm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function aE(e,t){let n=lE(e,t),r=cE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function lE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Cr(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function cE(e,t){let n=Qu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function rm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function uE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Cr(t)}var dE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",fE="git checkout --force discards uncommitted changes. Use 'git stash' first.",pE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",gE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",hE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",yE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",bE="git switch --force discards uncommitted changes. Use 'git stash' first.",CE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",SE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",vE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",EE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",xE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",RE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",_E="git push --force destroys remote history. Use --force-with-lease for safer force push.",wE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",AE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",PE="git branch -D force-deletes without merge check. Use -d for safe delete.",TE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",IE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",kE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",OE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",ME="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",DE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",NE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",LE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),WE=new Set(["--recurse-submodules","--track","-t"]),_a=new Set(["-b","-B","-U"]),wa=new Set(["-c","-C"]),GE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function am(e,t){let{subcommand:n,rest:r}=_e(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return xt(FE(r,t));case"switch":return xt(BE(r));case"restore":return xt(UE(r));case"reset":return jE(r);case"clean":return xt(KE(r));case"rm":return xt(qE(r));case"push":return Ht(YE(r));case"branch":return Ht(JE(r));case"stash":return Ht(rx(r));case"worktree":return Ht(ox(r));case"rebase":return xt(QE(r));case"merge":return xt(ex(r));case"tag":return Ht(tx(r));case"reflog":return Ht(nx(r));default:return null}}function xt(e){return e?{...e,localDiscard:!0}:null}function Ht(e){return e?{...e,localDiscard:!1}:null}function FE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:_a});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return S("git.checkout-force",fE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",gE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return S("git.checkout-ref-path",pE);return S("git.checkout-double-dash",dE)}let i=$E(e);if(i.length>=2)return S("git.checkout-ambiguous",hE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(zE(s)||t(s))return S("git.checkout-double-dash",mE);return null}function zE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function BE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",yE);let n=me(t,{shortOptsWithValue:wa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",bE);return null}function $E(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(LE.has(r)){n+=2;continue}if(WE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function UE(e){let t=HE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",SE):S("git.restore-unstaged",CE)}function HE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(GE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function jE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",vE);break}if(M(n,"--merge")){t=S("git.reset-merge",EE);break}}if(!t)return null;return VE(e)?Ht(t):xt(t)}function VE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function KE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",xE);return null}function qE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",RE):null}function YE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",AE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||sm(t,n).some(ZE))return S("git.push-force",_E);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||sm(t,n).some(XE))return S("git.push-delete",wE);return null}function sm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function ZE(e){return e.startsWith("+")||e.includes(":+")}function XE(e){return e.length>1&&e.startsWith(":")}function JE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",PE);return null}function QE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",TE):null}function ex(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",IE):null}function tx(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",kE):null}function nx(e){return e[0]==="delete"?S("git.reflog-delete",OE):null}function rx(e){for(let t of e){if(t==="drop")return S("git.stash-drop",ME);if(t==="clear")return S("git.stash-clear",DE)}return null}function ox(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",NE);return null}import{dirname as Rx,isAbsolute as _x,join as xm,resolve as wx}from"path";var Pa="TMPDIR",Ta="IFS",cm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,um=/^[A-Za-z_][A-Za-z0-9_]*$/,dm=new Set(["export","typeset","declare","readonly"]),ix=new Set(["builtin","command","time"]),mm=new Set(["do","then","else"]),sx=new Set(["do","then","case"]),lm=new Set(["done","fi","esac"]),ax=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function fm(e,t){return e.map((n)=>n.provenance==="variable"&&Sm(n.text)?pm(n.text,t.shellAssignments):w(n))}function pm(e,t){return e.replace(ax,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=pm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function gm(e,t){return{env:e,effectiveEnvAssignments:dx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function hm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=bm(e,t),r=e[0]??"";if(sx.has(r))t.bodyDepth+=1;if(r==="elif"||lm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(lm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&dm.has(e[o]??""))e.filter((a)=>um.test(a)&&Aa(a)).forEach((a)=>{mx(t,a)});let i=o===-1?-1:Cm(e,o);if(i===-1||e[i]!=="unset")return;let s=px(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(mm.has(r)){t.shellAssignments.set(a,"");return}fx(t,a)})}function ym(e,t){let n=bm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function bm(e,t){let n=mm.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Sm(a)),o=r!==-1&&dm.has(e[Cm(e,r)]??""),i=ux(t);return{assignments:e.flatMap((a,l)=>{let c=lx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!_o(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Cm(e,t){let n=t;while(ix.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Sm(e){return Pe(e)!==null||cm.test(e)}function lx(e,t,n){return Pe(e)??cx(e,t,n)}function cx(e,t,n){let r=wo(e,n,t);if(r)return r;let o=e.match(cm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function ux(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function dx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function mx(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function fx(e,t){if(!Aa(t)&&!um.test(t))return;if(e.shellAssignments.set(t,""),_o(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||$n(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function px(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as gx}from"path";function Yo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function xn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(gx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=vm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=vm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function vm(e,t,n){try{let r=yt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Em(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yo(n.environment.env,n.envAssignments))return null;let r=xn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=_e(e),i=r?.toLowerCase();if(t.dynamicArguments||hx(o)||vx(e,t.environment.env,t.envAssignments,n)||Cx(o)||yx(i,o))return!0;return i==="clean"&&Sx(o)>1}function hx(e){return e.some((t)=>/[$*?[]/.test(t))}function yx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||bx(s))||r.has("-C");return o&&i}return!1}function bx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Cx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Sx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function vx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=qo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>xx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Ex(s.value);if(td(n))return!0;return r.recursiveSubmodules}function Ex(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function xx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Rm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??w(l)),o=n.environment.paths,i=xn(r,n.cwd,o),s=n.originalCwd?o.realpath(wx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Yo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Px(e,n.shellAssignments,o):_m(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Ax(a,r,t,n)||!bn(a,n.environment)||Fo(a,n.environment)||Cn(s,a)||Cn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Ax(e,t,n,r){let o=r.environment.paths,i=xm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function Px(e,t,n){let r=_e(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Ye(l,t??new Map))??a;if(!_x(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function _m(e,t){if(t.entryKind(xm(e,".git"))!=="missing")return e;let n=Rx(e);return n===e?null:_m(n,t)}var Ix="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",kx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Zo(e,t){return wm(e,t)}function wm(e,t,n){let r=e.map(w),o=om(r,t.environment.env,t.envAssignments),i=o.blockedReason?T(S("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((ed(t.envAssignments)||im(r,t.environment.env,t.envAssignments))&&Ox(s))return S("git.ssh-env",Ix);let a=am(s,(c)=>{let d=xn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(Tx(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Em(r,a,t)??Rm(e,a,t);if(!l)return a;return n?.(l),null}function Am(e,t){let n=null;return{match:wm(e,t,(o)=>{n=o}),relaxation:n}}function Ox(e){let{subcommand:t,rest:n}=_e(e),r=t?.toLowerCase();if(!r)return!1;if(kx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&Mx(n)}function Mx(e){return e.find((t)=>!Dx(t))?.toLowerCase()==="update"}function Dx(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as cR}from"path";function Pm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Xo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Tm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Nx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Lx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",km="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Wx="rm -rf in home directory is dangerous. Change to a project directory first.",Im={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:km},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Lx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Wx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Tm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Nx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Tm}};function Jo(e,t){let n=Et({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Vo(r),s=Fx(e);for(let a of s){let l=pr(a.word);if(o&&l.unsafeBraceExpansion){let c=T(fr({kind:"outside_anchored_cwd"},n,t.policy,Im),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=Se(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Ft(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let u=Fe(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",km);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let u of Gx(d,n,m)){let f=fr(u,n,t.policy,Im),g=T(f,t.policy);if(g)return g}}}return null}function Gx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Fx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Rt={kind:"none"},jt={kind:"dynamic"},zx=new Set(["<","<<","<<-","<<<","<&","<>"]),Mm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Bx=/^(?:[0-9]+|[@*])$/,$x=ht.maxWords,Dm=ht.maxInputLength;function Nm(e){if(!e||I(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function qo(e){let t=bn(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(hr))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function km(e){let t=bn(e[1])==="--"?2:1,n=e[t],r=bn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!hr(n))return $t;return{kind:"literal",source:r}}function Yo(e,t){let n=Dm(e);if(n===-1)return Ct;let r=Wx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Fx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>Nx||i>Tm)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Nm)].filter((s)=>s!==null).join(" ")}}function Om(e,t){let n=Dm(e),r=e.slice(n+1);if(n===-1||!r.every(hr)||/\bIFS\b/.test(t))return t;let o=r.map(bn),i="",s=null,a=0;while(a<t.length){let l=t[a]??"",c=s==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(a));if(c){let u=c[1]??c[2],m=u==="@"||u==="*"?o.slice(1):[o[Number(u)]??""];if(s!=='"'&&m.some((d)=>/[*?[]/.test(d)))return t;if(i+=s==='"'?m.map((d)=>d.replace(/["$`\\]/g,"\\$&")).join(u==="@"?'" "':" "):m.map((d)=>d.split(/[ \t\n]+/).map((f)=>f?Nm(f):"").join(" ")).join(" "),i.length>Tm)return t;a+=c[0].length;continue}if(l==="\\"&&s!=="'"){i+=t.slice(a,a+2),a+=2;continue}if(l==="'"&&s!=='"'||l==='"'&&s!=="'")s=s?null:l;i+=l,a++}return i}function Mm(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Mx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function st(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=bn(n);return fo(n,r)?{kind:"literal",source:r}:$t}var Lx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ma(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(O(s));return!Lx.has(a)&&!Y.has(a)&&!Gt(a)}function Dm(e){return ve(e.map(w)).commandIndex??-1}function Wx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Gx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function Gx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Fx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ia(o):zx(o,r);if(e.parameter==="*"){let a=Ia(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:ka(l,r)}let i=t[n+1+e.parameter];if(i&&!hr(i))return;let s=bn(i);return e.quoted?[s]:ka(s,r)}function Ia(e){return e.every(hr)?e.map(w):void 0}function zx(e,t){let n=Ia(e);if(!n)return;let r=n.map((o)=>ka(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function ka(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Qo(e){let t=Rn(e[1])==="--"?2:1;if(e.length<=t)return Rt;let n=e.slice(t);if(!n.every(vr))return jt;return{kind:"literal",source:n.map(w).join(" ")}}function Lm(e){let t=Rn(e[1])==="--"?2:1,n=e[t],r=Rn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Rt;if(!vr(n))return jt;return{kind:"literal",source:r}}function ei(e,t){let n=Fm(e);if(n===-1)return Rt;let r=Hx(t);if(!r)return Rt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Vx(s,e,n,r.ifs);if(!a)return jt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>$x||i>Dm)return jt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(zm)].filter((s)=>s!==null).join(" ")}}function Wm(e,t){let n=Fm(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(vr)||o)return t;let i=r.map(Rn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let m=d[1]??d[2],u=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&u.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?u.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):u.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?zm(p):"").join(" ")).join(" "),s.length>Dm)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function Gm(e,t,n,r){if(!Ee(e.map(w)).readsStdinAsCommands)return Rt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&zx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Rt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return jt;return{kind:"literal",source:o.target.text}}if(!n)return Rt;return r===void 0?jt:{kind:"literal",source:r}}function lt(e,t=new Map){let n=Ee(e.map(w)).scriptIndex;if(n===null)return Rt;let r=e[n],o=Rn(r);if(Co(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?jt:{kind:"literal",source:i}}var Ux=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(O(s));return!Ux.has(a)&&!q.has(a)&&!$t(a)}function Fm(e){return Ee(e.map(w)).commandIndex??-1}function Hx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(jx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function jx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Vx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):Kx(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!vr(i))return;let s=Rn(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(vr)?e.map(w):void 0}function Kx(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function hr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function bn(e){return e?w(e):""}function Nm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Da(e,t){return Oa(De(e,"posix"),t)}function yr(e){return Da(e,new Set(Array.from(e.matchAll(Pm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Oa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Oa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Oa(o,n))||Lm(r.words,n))return!0;jx(r,n)}return!1}function Lm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(gr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Am(e[s],t)}if(Y.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Am(s[l],t)}let i=$x(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Lm(e.slice(i),t)}function $x(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Bx(e,t+1);if(r==="exec")return Ux(e,t+1);if(r==="env")return Hx(e,t+1,n);return null}function Bx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Ux(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Hx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return gr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return gr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function jx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(gr(n,t))t.add(r.name)}}function gr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Pm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Dx.test(o)||t.has(o))}))}function Am(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||gr(e,t))}var Na="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",La="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Vx="__CC_SAFETY_NET_XARGS_INPUT__",Zo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Xo="rm",Kx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,qx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Yx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Zx=/^(?:[0-9]+|[@*])$/;function Fm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Bt(n),i=n.slice(r),s=S("xargs.shell-dynamic",La);if(Jx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=jm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Um(l,o),d=t.analyzeChild(l,{...Ft(a,t),dynamicInput:u,dynamicSourceInput:m||$m(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Na)});if(d)return d;let f=Xx(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,Vx]:l,h=o!==null&&(l.some((C)=>C.includes(o))||Array.from(a.envAssignments.values()).some((C)=>C.includes(o))),y=t.analyzeChild(g,{...Ft(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=rt(l,t.policy?.rules??[]);if(p)return p}return null}function Xx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=rt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function zm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=xm(e,r,t.length,n);return o===null?[]:[o]}function $m(e,t,n,r,o,i,s){if(Y.has(t)){if(ot(e))return!1;if(n!==null&&Qx(e,n,s))return!0;let a=Be(e);if(!a){let l=st(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Bm(a,n,s))return!0;if(Ae(a))return!0;return eR(a,n,r)}if(Me(t))return Wm(e,n,bo,ju(t));if(we.has(t))return Wm(e,n,pa,jd);if(t==="eval"){let a=qo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return tR(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&hn.has(a.subcommand.toLowerCase())&&Hm(a.rest,n).some((l)=>l.includes(n))}return!1}function Bm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Wm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Zo]).sources.some((a)=>a.value===Zo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Zo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Zo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>zm(l,t,a))));return Vo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Jx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Xo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Xo));return Array.from(ze(o,n)).some((i)=>i.head===Xo&&!r.has(Xo))}function Um(e,t){return Hm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Hm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function jm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Qx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Bm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return zm(a,t,s).some((u)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,u):f),d=ve(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function eR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Kx))if(Gm(o,r))return!0;for(let o of e.matchAll(qx))for(let i of(o[1]??"").matchAll(Yx))if(Gm(i,r))return!0;return Da(e,r)}function Gm(e,t){let n=e[1]??e[2];return n!==void 0&&(Zx.test(n)||t.has(n))}function tR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Ke(s)){let l=gn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=jm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Um(c.tokens,t)||$m(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=it(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Bt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var br="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Sr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",rR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",oR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Qo=/\{[^{}\s]*\}/g,Vm=/\{\}|\{-?\d+\}/g,iR=["e","f","source","file","-e","-f","--source","--file"],sR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],aR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),lR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Km=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),cR=new Set(["--workdir","--wd"]),qm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Qm(e){return Ie([...e],(t)=>Ae(t))}function ef(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Sn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=uf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=Sn(t);if(p)return p;let g=Qm(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=gR(t);if(p)return p}if(u!==void 0&&a){let p=Sn(t);if(p)return p}let d=hR(u,t.cwd,t.environment.paths);if(d===null){let p=Sn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some(Fa)){let g=Sn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=of(f.envAssignments,f.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,f),(p)=>uR(p,o,t,f))}function uR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(lf)){let h=Sn(n);if(h)return h}let u=Qm(c);if(u)return u;let m=c.some(G),d=i||m,f=a&&d,p=of(e.envAssignments,e.wrapperCwd,s||f);if(Y.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Jo(l,E,n.budget),Ft(e,r)))};if(ot(l))return h();let y=Be(l);if(y){if(cf(y)){let x=vt(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(Xm(y,A,n.budget),p))}if(G(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(Xm(y,q,n.budget),p));let x=fr(y);if(x?.[0]&&O(x[0])==="rm"&&$e(x)){let q=Zm(n);if(q)return q}let A=x?n.analyzeChild(x,{...Ft(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",Sr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",br)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Yo(K(x===void 0?l:i?l.map((A)=>sf(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=vt(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(yr(y)){let x=vt(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return vt(n);return null}let C=st(K(l));if(C.kind==="dynamic"||C.kind==="literal"&&G(C.source))return vt(n)??h();if(C.kind==="literal")return h();if(o.length>0){let E=vt(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return vt(n)??h();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Ie(o,(y)=>Wa(Jo(l,y,n.budget,Vm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Wa(Jm(l,y,n.budget),e.cwd,r));let h=Wa(l.flatMap((y,C)=>{if(C===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Vm,"")]:[]}),e.cwd,r);if(h)return h;return Zm(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Jo(l,h,n.budget):Jm(l,h,n.budget),C=S("parallel.shell-dynamic",Sr),E=a&&e.head==="find"?pR(y,r):null,v=nf(y,a,n)??E?.customResult??null,T=O(e.head),x=a&&(T==="rm"&&Ga(y)||T==="xargs"&&rf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&tf(y,T)),q=n.analyzeChild(y,{...Ft(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:C,dynamicSourceMatch:C,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",br)});if(A){let X=P(C,n.policy);if(X)return X}return q??v??rt(y,n.policy?.rules??[])})}function tf(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Y.has(t))return fR(e);if(t==="git")return dR(e);if(t==="find")return!0;if(we.has(t))return Ym(e,iR,dr);if(Me(t))return Ym(e,sR,yo);return!1}function Ga(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||cf(o)))}function dR(e){if(mR(e))return!0;let t=Re(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!hn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function mR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function fR(e){if(ot(e))return!1;let t=Be(e);if(t!==null)return G(t);let n=st(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Ym(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,qm]).some((o)=>o.value===qm);return Vo(r,t,(o)=>n(e.map((i)=>sf(i,[o]))))}function nf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return vt(n);return Ie(o,(i)=>rt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function pR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of ze(i,t))n.executedSource||=tf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ga(a.tokens)||a.head==="xargs"&&rf(a.tokens),n.customResult??=nf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Ke(a)){i=[],n.executedSource||=G(a);continue}let l=it(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function rf(e){let t=e.slice(Bt(e).childStart);return O(t[0]??"")==="rm"&&Ga(t)}function ei(e,t){return(n)=>P(S(e,t),n.policy)}var vt=ei("parallel.shell-dynamic",Sr),gR=ei("parallel.command-stream-dynamic",rR),Sn=ei("parallel.command-stream-dynamic",oR),Zm=ei("parallel.rm-recursive-force-dynamic",br);function Wa(e,t,n){return P(Ko(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:bt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function of(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function sf(e,t){return e.replace(Qo,(n)=>af(n,t))}function Jo(e,t,n,r=Qo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=af(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Xm(e,t,n){return Jo([e],t,n)[0]??""}function Jm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function af(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Qo)!==-1}function lf(e){if(Fa(e))return!0;for(let t of e.matchAll(Qo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Fa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function cf(e){return/^\{[^{}\s]*\}$/.test(e)}function hR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!nR(e))return null;try{return pt(t??e,e,n)}catch{return null}}function uf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ya(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ya(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),C=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?C:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||lR.has(y)){c=!0,t+=C===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=C===void 0?2:1;continue}if(Km.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Km.has(p)?2:1;continue}if(cR.has(y)){c=!0;let E=C??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=C===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&C!==void 0){t++;continue}if(aR.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Fa:lf);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let m=yR(u),d=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function yR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function df(e){return uf(e).childStart}var bR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ti="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function $a(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function za(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function ff(e,t,n,r,o=!1,i){let a=(Un(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",bR):null;return P(a,i)??pf(e,t,n,o,i)}function pf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>$a(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=an(e,t),l=CR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(S("shell.dynamic-structure",ti),o);if(P(jo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&hn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(S("shell.dynamic-structure",ti),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&vR(t)?P(S("shell.dynamic-structure",ti),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=$e(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(S("shell.dynamic-structure",ti),o):null}if(s==="xargs")return mf(e,t.slice(Bt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return mf(e,t.slice(df(t.map(w))),"parallel",n,r,o);return null}function mf(e,t,n,r,o,i){if(t.length===0)return null;let s=SR(t,r);if(Un(e,s)){let l=P(S(`${n}.shell-dynamic`,n==="xargs"?La:Sr),i);if(l)return l}let a=pf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>$a(l)&&za(l)))return P(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Na:br),i);return null}function SR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function CR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Ce.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function vR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=$a(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||za(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||za(s)))return!0;continue}if(t=!0,a)return!0;let l=it(s.text);if(l>0){n=l;continue}if(Ke(s.text))o=!0,r=!0}return!1}function Ba(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!fo(t[n.tokenIndex],n.value)})}var ER="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",xR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",RR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function gf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",ER);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",xR);if(e==="shred"&&n.length>0)return S("shred.target",RR);return null}var yf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ko(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:bt(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>jo(e.words,Ua(e))},{heads:new Set(["find"]),analyze:(e)=>Jd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:bt(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Fm(e.words,{...hf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>ef(e.words,{...hf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function hf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ua(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function vf(e){return yf.find((t)=>t.heads.has(e))?.analyze}function vn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?w(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=vo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),k=Ae(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),de(k);if(n.strict)return ye(r);let L=Eo(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?K(i(f.words)):an(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let C=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(Gt(E))throw new D("wrapperPeelIterations");let v=O(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!sr(C,n.environment),X=ff(o,f.words,n.environment,t===0,n.strict,n.policy);if(X)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:X.reason}),de(X);let ee=Fo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){bf(y.wrapperNormalizationBudget);let k=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(k)});let L=vn(k,t,{...y,effectiveCwd:A,envAssignments:C});if(L)return L}return null}let J=l?void 0:v==="eval"?qo(g):v==="trap"&&!a?km(g):void 0;if(a&&s&&v==="eval"){if(J?.kind==="dynamic")return Cn(s,n.policy);if(J?.kind==="literal"){let R=n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:C});if(R)return R}return En(s,n.policy)}if(J?.kind==="dynamic"&&(n.strict||!n.commandView||!Ma(n.commandView)))return ye(r);if(J?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:J.source,depth:t+1});let R=n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:C,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?Y.has(v):xf(E,v)){if(ot(h))return null;if(a&&s){let R=Be(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=Cn(s,n.policy);if(L)return L}if(yr(R)){let L=Cn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:C})}let k=st(g);if(k.kind==="dynamic")return Cn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Cn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Cn(s,n.policy):null}if(l){let R=Be(h),k=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:C}):st(g).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=PR(h,C,A,n,r,t);if(R)return R;let k=Be(h);if(k){let qt=Yo(g,k);if(qt.kind==="dynamic")return ye(r);let bi=qt.kind==="literal"?qt.source:Om(g,k),yl=TR(bi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:yl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:yl,depth:t+1});let bl=n.analyzeNested(bi,{effectiveCwd:A,envAssignments:C});if(bl)return bl;return yr(bi)?ye(r):null}let L=st(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ni(L.source,A,C,n,r,t);let te=Mm(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:C})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let k=R===null?1:3,L=h[k]==="--"?k+1:k,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ni(te.text,A,C,n,r,t);if(n.strict||!n.commandView||!Ma(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&Ba(dr(h),g))return ye(r);let R=Vd(h,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:A,envAssignments:C}))),k=P(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),de(k)}if(Me(v)&&!l){if(!s&&n.strict&&Ba(yo(h),g))return ye(r);let R=Hu(h);if(a&&s)return wR(v,R,A,C,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:k}),k){let te=P(S("interpreter.one-liner-paranoid",Xn),n.policy);if(te)return de(te)}if(Vs(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:C});if(L&&!Ef(L,R))return L;if(Jn(R,void 0,!n.strict)){let te=P(S("interpreter.dangerous-command",un),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:un}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return bf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),vn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:C});let N=s?null:P(gf(v,h),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),de(N);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:C,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,k)=>a&&s?Ha(R,t,ue,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Ut(vn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:C}))??rt(R,ue.policy.rules),analyzeChild:(R,k)=>Ha(R,t,ue,k)},Ze=s&&(v==="xargs"||v==="parallel")?void 0:vf(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:C.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?Em(_e.words,Ua(_e)):void 0,hi=Sf(ke?ke.match:Ze?.(_e)??null,n.policy);if(r)IR(_e,hi,ke?.relaxation??null);if(hi)return de(hi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&($e(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?En(s,n.policy):null)??AR(s,n.policy)}let hl=!s&&Ze===void 0&&!Fr.has(v),yi=r&&hl?[]:void 0;if(hl)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;yi?.push(k);let L=Sf(_R(h,R,t,ue,T,x,A,C),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[],embeddedCommandFound:O(k)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[]}),l&&s&&!s.wrappedByTransparent)return null;let Ar=rt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ar,reason:Ar?.reason}),Ar)return de(Ar);return a&&s?En(s,n.policy):null}function Ha(e,t,n,r){return Ut(vn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function _R(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(xf(c,u)||vf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Ha(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!sr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function wR(e,t,n,r,o,i){if(!t)return En(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(S("interpreter.one-liner-paranoid",Xn),o.policy);if(a)return de(a)}if(Vs(e,t))return En(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Ef(s,t))return s;if(Jn(t,void 0,!o.strict)){let a=P(S("interpreter.dangerous-command",un),o.policy);if(a)return de(a)}return En(i,o.policy)}function Ef(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Lo)||e.reason===pn)&&!zr(t)}function Cn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function En(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function AR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function PR(e,t,n,r,o,i){let s=Xd(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ni(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ni(a,n,t,r,o,i,!0)}function ni(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=Zn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function TR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function IR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function bf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:cr}),de(kR())}function kR(){return{id:"",reason:cr,intent:"stop_and_explain"}}function xf(e,t){return Y.has(t)||e==="$SHELL"||e==="${SHELL}"||Y.has(I(t))}function Sf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var OR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,MR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function DR(e,t){let n=wf(e,t);if(n.length===0)return!1;let r=n[_f(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return OR.test(e.join(" "))}function Rf(e,t,n,r,o){if(e.dialect==="powershell"){let h=LR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return Cf(zR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!DR(i,n))return s?null:void 0;if(!t)return null;let a=wf(i,n,t),l=_f(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?NR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return Cf(g,t,n.paths)}function NR(e,t){let n=pr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function Cf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return pt(t,e,n)}catch{return null}}function LR(e,t){let n=WR(e[0])?1:0,r=e[n];if(!GR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!MR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return FR(e.slice(n+1),t)}function WR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function GR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function FR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function zR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function _f(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function wf(e,t,n){let r=$R(e);return gt([...r],t,n)}function $R(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var BR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ya(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return qa(e,n);let u=`${Lo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Of(e,n),{reason:pn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Of(e,n),{reason:pn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return qa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=um(n.environment.env,n.envAssignments);return ii(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ii(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=UR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],C=f||Rn(m);if(c.kind==="function"){let X=g.flatMap((J)=>{let U=_n(J);return U.functionDefinitions.set(c.name,c.body),ja(J,[U],d,m==="&",Rn(m))}),ee=Va(X,[],h,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let X=[],ee=[];for(let U of g){let N=ii(c.body,t,n,r,[_n(U)]);if(N.result)return N;if(X.push(...ja(U,N.states,d,m==="&",Rn(m))),C)ee.push(U,...d?N.states.map((ue)=>ri(U,ue)):N.states)}let J=Va(X,ee,h,y,a,m);i=J.states,s=J.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=si(a)&&v?.kind==="command"?Im(v)??jR(v):void 0,x=[],A=[];for(let X of g){let ee=VR(c,t,n,r,[_n(X)]);if(ee.result)return{result:ee.result,states:i};let J=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ri(X,U));for(let U of J){let N=_n(U),ue=YR(c,t,n.trace?{...n,trace:Mf(n.trace,E)}:n,r,N,si(a),T);if(ue)return{result:ue,states:i};let _e=d_(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",ai(_e));let Ze=_e?t+1>=V.recursionDepth.cap?Ka(c.displayText,n,[N]):ii(_e,t+1,n,r,[N]):{result:null,states:c_(c,N)};if(Ze.result)return Ze;if(x.push(...ja(X,Ze.states,d,m==="&",Rn(m))),C)A.push(X),A.push(...Ze.states.map((ke)=>d?ri(X,ke):ke))}}let q=Va(x,A,h,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function UR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(si(r)||si(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&HR(e,t)}function ja(e,t,n,r,o){let i=n?t.map((a)=>ri(e,a)):[...t],s=o?i.flatMap((a)=>xn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ri(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function HR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(KR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function si(e){return e==="|"||e==="|&"}function jR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Rn(e){return e==="&&"||e==="||"}function Va(e,t,n,r,o,i){let s={success:oi([...n,...e]),failure:oi([...r,...t])},a=Rn(i)?s:void 0;return{states:Rn(o)||a?oi([...s.success,...s.failure]):s.success,conditionalStates:a}}function Mf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function VR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=qR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ka(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Ka(s,n,o);if(a.status!=="complete")return Af(i,n,r,o);n.budget.charge("derivedTokens",ai(a)),i.push({program:a,depth:t+1})}}return Af(i,n,r,o)}function KR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Af(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ii(i.program,i.depth,t,n,[_n(a)]);if(l.result)return l;s.push(...l.states)}o=oi(s)}return{result:null,states:o}}function qR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ai(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ai(o),0):n.kind==="group"||n.kind==="function"?ai(n.body):0),0)}function Ka(e,t,n){return t.trace?.recordSegment({type:"error",message:je}),{result:{reason:je,segment:e,intent:"stop_and_explain"},states:[...n]}}function YR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=n_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Df(e,o,"before-consumer",a.environment.paths,a.budget);let c=an(e.dialect,e.words),u=c.map(w),m=e.displayText,d=cm(c,o.shellGitContextState),f=mm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Gd(e,i,f_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return m_(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Un(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&zu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let C=Pf(e,l,o,f,s,a);if(C)return C;return Aa(d,o.shellGitContextState),null}let p=vn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let C=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Ya(h,t+1,{...a,effectiveCwd:C,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Mf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let g=Pf(e,l,o,f,s,a);if(g)return g;return Aa(d,o.shellGitContextState),null}function Pf(e,t,n,r,o,i){let s=r_(e,t,n,r??new Map,i);if(s)return s;return Df(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),JR(e,t,n,i.environment.paths,i.budget),s_(e,n,o,i.environment,i.trace),null}var ZR=new Set([">>","<>"]);function Df(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?XR(s):ZR.has(s.operator)))continue;Tf(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=Nf(e.words.slice(1));if(!i)return;for(let s of i.operands)Tf(s,t,r,o)}function XR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Tf(e,t,n,r){let o=e?.provenance==="literal"?Zn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function JR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of QR(e)){let a=Zn(s.text,n.effectiveCwd,r,o);if(!a||!Uu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function QR(e){let t=t_(e.redirections)?.target,n=If(t)?[t]:[];if(le(e.words[0],"cat"))return e_(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=Nf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(If))return[];return[...r.operands,...n]}function e_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function t_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Nf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function If(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Za(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function n_(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Ht;let r=n[0];if(!r?.heredoc)return Ht;if(!Za(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return BR;if(r.fd!==void 0&&r.fd!==0)return Ht;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return Ht;let o=e.redirections.some((a)=>a!==r&&kf(a.target));if(le(e.words[0],"cat"))return o?Ht:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(kf)?Ht:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return Ht}function kf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function r_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(i_(e,i,n,r,o))return null;let a=o_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=qa(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function o_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Za(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>le(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(S("interpreter.one-liner-paranoid",Xn),n.policy);if(m)return m}if(!Jn(l,void 0,!n.strict))return null;let u=P(S("interpreter.dangerous-command",un),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function i_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Za(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Y.has(l)&&!Y.has(I(l)))return!1;return ot(a)}function s_(e,t,n,r,o){let i=Rf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var a_=/^[A-Za-z_][A-Za-z0-9_]*$/,l_=8;function c_(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!a_.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=l_&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=_n(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function _n(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:dm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function oi(e){let t=[];for(let n of e){if(!t.some((r)=>u_(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function u_(e,t){return e.effectiveCwd===t.effectiveCwd&&xn(e.shellGitContextState.env,t.shellGitContextState.env)&&xn(e.literalHeredocFiles,t.literalHeredocFiles)&&xn(e.functionDefinitions,t.functionDefinitions)&&xn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&xn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function xn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function d_(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function m_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function f_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function qa(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Of(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:pn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var p_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Lf(e,t,n,r){let o=Ya(e,0,{...t,...lu(t),budget:t.budget??be(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Wf(e,t,n){try{return{decision:e()}}catch(r){let o=g_(r,t,n);if(!o)throw r;return o}}function g_(e,t,n){if(!(e instanceof D)||!p_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var h_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Ja=new Set(["cc-safety-net","ccsn"]),y_=new Set(["bunx","npx","pnpx"]),b_=new Set(["pnpm","yarn"]),S_=new Set(["npm","pnpm","yarn"]),C_=new Set(["bun","node"]);function ci(e,t,n={}){if(Ja.has(e))return 0;if(y_.has(e)){if(n.broad)return Xa(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&S_.has(e)&&n.broad&&t[r]==="exec"){let o=Xa(t.slice(r+1));return o===null?null:r+1+o}if(b_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Xa(t.slice(r+1));return o===null?null:r+1+o}if(C_.has(e)){let o=n.broad&&r!==-1?r:0;if(Gf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Gf(t[o+1]))return o+2}return null}function Xa(e){let t=e.findIndex((r)=>li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!li(r))break;n++}return n}function li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Ja.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Ja.has(e.slice(0,t))}function Gf(e){let t=e?.replaceAll("\\","/");return[...h_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Ff="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function zf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=mn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>v_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function v_(e,t){let n=gt([...e],t),r=n.slice(1),o=ci(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ui}from"path";var Hf="This path contains the protected policy config and you must not modify or delete it.",E_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function jf(e,t,n){let r=P_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return $f(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Bf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Bf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return $f(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Tr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function $f(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Cr(a,n,r,o,i));return s?{target:s}:null}function Bf(e,t,n,r,o){let i=mn(e,t,r,o,{findSegmentTarget:(s,a)=>x_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Cr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>A_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function x_(e,t,n,r,o){if(rr(e))return null;let i=ht([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&R_(a)){let l=__(a).find((c)=>Uf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Bo(i,1)||Sa(i,r)){let c=(mr(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return Cr(m,t.cwd,n,r,o)||Uf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Po(a).sources.find((c)=>T_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(w_(i,s))return null;for(let l of[...e,...i])for(let c of Vf(l))if(Cr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function R_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function __(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function w_(e,t){if(!E_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function A_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Vf(i))if(Cr(s,t,n,r,o))return{target:s};return null}function Vf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function P_(e,t,n){let r=(a)=>vr(se(a,e.executionCwd,t,n)),o=r(en(t)),i=[r(Gn(e.executionCwd)),r(Gn(e.configCwd))],s=new Set(i.map((a)=>ui(a)));for(let a=ui(o);;a=ui(a))if(s.add(a),ui(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Cr(e,t,n,r,o){let i=$l(e,t,r,o,(s)=>vr(s)===Wr);return i!==null&&n.files.has(vr(i))}function Uf(e,t,n,r,o){return n.directoriesAndAncestors.has(vr(se(e,t,r,o)))}function T_(e,t,n,r,o){let i=vr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function vr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as di,posix as op,resolve as fi,win32 as I_}from"path";import{fileURLToPath as k_}from"url";var ip="Access to a sensitive path is not allowed.",sp=new Set(["echo","printf"]),O_=new Set(["find"]),M_=new Set(["!","do","elif","else","if","then","until","while"]),D_=new Set(["-exec","-execdir"]),N_=new Set([";","+"]),L_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),W_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),ap=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),G_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),F_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),lp=new Set(["-c","-e","-r","-E","--eval","--exec"]),z_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),$_=new Set(["grep","rg"]),B_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),U_=new Set(["commit","merge","notes","stash","tag"]),H_=new Set(["-m","--message"]),j_=new Set(["--grep"]),Kf=new Set(["jq","gojq","jaq"]),qf="f",Yf="file",V_="files",K_=new Set(["e","f"]),q_=new Set(["regexp","file"]),Y_=new Set(["e","f","A","B","C","m"]),Z_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Qa="__CC_SAFETY_NET_PIPE_INPUT__",tl=/[\w./~@+-]*[./~][\w./~@+-]*/g,X_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,J_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Q_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Zf=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Xf=/\b(?:system|exec|spawn|popen)\s*$/,ew=/\b(?:eval|exec)\s*\(/g,tw=/\b(?:eval|exec)\s*$/,nw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Jf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Qw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Xw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(gp(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!rl(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!rl(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&eA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function cp(e,t,n,r,o={}){let i=Qf(e,n,r),s=Jf(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Jf(i,t,e.invocation.context.configCwd,n,r,new Set(Qf(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&rw(e,n)?null:a}function rw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Ao(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(nt(s.text,t))}let o=lt(r);if(o.length===0)return!1;let i=He(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return ol(i,o.slice(1))}function ol(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>L_.has(n))}function Qf(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?wn(s.shell,e.store,r,t,o,n,ow(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function ow(e){return e.program.dialect==="powershell"}function wn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Dw(nt(e.source,r),t,n,r,o,i)],l=(c)=>nt(gw(c,s),r);return wo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...pi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...sw(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...up(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>aw(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return ta;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function il(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?wn(s,t,n,r,o,i):null}function pi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(Kf.has(He(lt(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...pi(g,t,n,r,o,i)]}let l=pw(e).map(a),c=lt(e);if(c.length===0)return l;let u=c[0]??"",m=He(u).toLowerCase(),d=c.slice(1),f=c.findIndex((g)=>!M_.has(g));if(n.standard===!0&&f!==-1&&ol(He(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=iw(u,m,d);if(p)return[...l,...p.map(a)];if(sp.has(m))return n.capturedOutput===!0?[...l,...dp(e).map(a)]:l;if(m==="eval")return[...l,...il(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ye(m,g)).map(a)];if(m==="git")return[...l,...yw(d).map(a)];if(m==="gh")return[...l,...nl(m,d,B_).map(a)];if(Kf.has(m))return[...l,...hw(d).map(a)];if($_.has(m))return[...l,...Bw(d).map(a)];if(O_.has(m))return[...l,...vw(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((g)=>Ye("awk",g)).map(a),...d.flatMap((g)=>xw(g,t,n,r,o,i)),...d.flatMap(Rw).map(a)];if(m==="curl")return[...l,...d.flatMap((g)=>Ye(m,g)).map(a),...bw(d).map(a)];if(or(m)){let g=nr.has(m)?ve([m,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...wn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...Ew(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ye(m,g)).map(a)]}function iw(e,t,n){let r=ci(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function sw(e,t,n,r,o,i,s){if(dw(t,n,r,o,i,s)){let a=lt(e),l=ol(He(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...dp(e),...l].map((c)=>({target:c,cwd:i}))}return up(t,lw(e),n,r,o,i,s,()=>[])}function aw(e,t,n,r,o,i,s){let a=lt(e);if(!or(He(a[0]??"").toLowerCase()))return[];return il(t,n,r,o,i,s)??[{target:t,cwd:i}]}function up(e,t,n,r,o,i,s,a){let l=mw(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>nr.has(l)?wn(n.getShellSyntax(c),n,r,o,i,s):mi(l,c,n,r,o,i,s))}function dp(e){let t=lt(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase();if(!sp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[sl(r.replaceAll("%%","%"))];return t.slice(1)}function lw(e){let t=lt(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return cw(r);return[]}function cw(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[sl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>uw(t,r.slice(i*n,(i+1)*n)))}function uw(e,t){let n=0;return sl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function sl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function dw(e,t,n,r,o,i){let s=lt(e);if(s.length===0||He(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Bt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Qa]:l.map((m)=>m.split(c).join(Qa));return pi(u,t,n,r,o,i).some((m)=>m.target.includes(Qa))}function mw(e){let t=lt(e);if(t.length===0)return null;let n=He(t[0]??"").toLowerCase();if(!or(n))return null;return fw(n,t.slice(1))?n:null}function fw(e,t){let n=al(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(lp.has(o)||mp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(nw.get(n)?.has(o))r++;continue}return!1}return!0}function al(e){return/^python\d/.test(e)?"python":e}function pw(e){let t=[];for(let n of e){if(pp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var ep=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function gw(e,t){if(!t||!ep.test(e))return e;return`~${e.replace(ep,"").replace(/\\/g,"/")}`}function Ye(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function hw(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ye("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ye("jq",r))}function yw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...U_.has(r)?nl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),H_):nl("git",e.slice(n),j_)];if(t.push(...Ye("git",r)),!Ce.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ye("git",o)),n++}return t}function nl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ye(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ye(e,i))}return r}function bw(e){return e.flatMap((t,n)=>{let r=Cw(t);if(r!==null)return tp(r.flag,r.value);let o=Sw(e[n-1]);return o===null?[]:tp(o,t)})}function tp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return el(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return el(t.slice(n+1))}return t.startsWith("@")?el(t.slice(1)):[]}function Sw(e){if(e===void 0)return null;if(ap.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Cw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return ap.has(r)?{flag:r,value:e.slice(n+1)}:null}function el(e){return e===""||e==="-"?[]:[e]}function vw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!D_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>N_.has(f)),m=u===-1?c:c.slice(0,u),d=pi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!W_.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Ew(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(lp.has(c)||mp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...mi(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...mi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function mp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return z_.get(t[t.length-1]??"")?.has(al(e))??!1}function xw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ga(e)?.commands.flatMap((s)=>wn(t.getShellSyntax(s),t,n,r,o,i))??[]}function Rw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function _w(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ll),...e.match(tl)??[]]}function mi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=Aw(t,ww(e));if(l===null)return _w(t).map(a);let c=l.masked.match(Zf)!==null||l.literals.some((g)=>Xf.test(l.masked.slice(0,g.start))),u=l.masked.match(ew)!==null||l.literals.some((g)=>tw.test(l.masked.slice(0,g.start))),m=r.standard===!0&&!nr.has(e),d=m&&!(kw(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(Zf),(g)=>{let h=g.index+g[0].length;return{start:h,end:qs(l.masked,h)}}):[],p=!m||f.some((g)=>Ys(l.masked,g.start))?l.literals:l.literals.filter((g)=>Xf.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>ll(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(tl)??[]).map(a),...c?p.flatMap((g)=>il(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>mi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
-`:y),n,r,o,i,s)):[],...(l.masked.match(tl)??[]).map(a)]}function ww(e){let t=al(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Aw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(J_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Iw(e,o))return null;let a=t==="python"?Pw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=Tw(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&Q_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Pw(e,t){return X_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function Tw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Iw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function kw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(G_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>F_.has(i)))continue;if(o.length>1)return!0;if(Ow(e,r)===".")return!0;if(Mw(e,r+n.length)==="(")return!0}return!1}function Ow(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Mw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Dw(e,t,n,r,o,i){return Fw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...wn(a,t,{...n,capturedOutput:!0},r,o,i),...Nw(a,r)?Lw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Nw(e,t){let n=Ao(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||He(nt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=nt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Lw(e,t){return Ao(e).flatMap((n)=>n.kind==="word"?[nt(n.text,t)]:n.kind==="redirection"&&n.target?[nt(n.target,t)]:[]).flatMap(ll)}function ll(e){let t=Gw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Ww(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Ww(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function Gw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Fw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Fn(o,n))continue;if(fp(e,r,n)){let i=zw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=$w(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function zw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Fn(i,n))continue;if(fp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function $w(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function fp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Bw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===V_)o=!0;if(q_.has(m))r=!0;if(d!==void 0){if(m===Yf)t.push(d);continue}if(Z_.has(m)){let f=e[l+1];if(m===Yf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(K_.has(h))r=!0;if(Y_.has(h)){d=h,f=m.slice(g+1);break}}if(d==="")continue;if(f.length>0){if(d===qf)t.push(f);continue}let p=e[l+1];if(d===qf&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function lt(e){let t=e.findIndex((n)=>!pp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function pp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var Uw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Hw=".env.",jw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Vw=[".env.example.",".env.sample."];function Kw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function qw(e){return e.length>0&&!/\s/.test(e)}function rl(e,t,n,r){let o=gp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function gp(e,t,n,r){try{return Rr(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var Yw=new Set(["node_modules","__pycache__"]),Zw=[["vendor","bundle"],["vendor","cache"]];function Xw(e,t,n,r,o){if(Kw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=F(i.split("/").pop()??""),a=F(i),l=()=>qw(s)||rl(e,t,r,o);if(jw.has(s)||Vw.some((d)=>s.startsWith(d)))return null;let c=F(rA(e,t,r,o));for(let d of cs){let f=`~/${d.suffixParts.join("/")}`;if((rp(a,f)||rp(c,f))&&at(d.id,n))return d.id}let u=Jw(i,t,n,r,o);if(u)return u;if(Uw.has(s))return null;for(let d of ls)if(s===d.basename&&at(d.id,n))return d.id;if(s.startsWith(Hw)&&at(Hr.id,n)&&l())return Hr.id;for(let d of us)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&at(d.id,n)&&l())return d.id}for(let d of ds)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&at(d.id,n))return d.id}if(tA(a))return null;if(!s.includes(".")&&zn.pattern.test(s)&&at(zn.id,n))return zn.id;let m=nA(s,n);if(m)return m;return null}function Jw(e,t,n,r,o){return jr.find((i)=>{if(!at(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=F(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||xr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Er(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=F(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=F(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?xr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Er(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Er(e,s,["credentials"])||Er(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=F(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=F(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>xr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(F(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?xr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,qe(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Er(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(qe("~",t,r,o),".config","amp")],l=F(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?xr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||F(e).split("/").at(-1)==="mcp-auth.json"&&jt(F(e),F(a))}case"secret.cli.cursor.config":{let s=F(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=F(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var np=new WeakMap;function B(e,t,n,r,o){let i=np.get(o)??new Map;np.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>hp(e,ce(t,r)))}function Er(e,t,n){return n.some((r)=>jt(F(e),F(ce(t,r))))}function xr(e,t,n,r,o){return hp(e,qe(t,n,r,o))}function hp(e,t){return F(e)===F(t)}function ce(e,...t){return Ue([e,...t].filter(Boolean).join("/"))}function Qw(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Rr(e,t,o,i));return n.some((a)=>jt(s,F(Rr(a,r,o,i))))}function eA(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Rr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ue(z(Se(a),o.paths,i)):"",c=F(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=F(u?Ue(z(fi(Se(u)),o.paths,i)):l&&Ue(z(`${l}/.cc-safety-net`,o.paths,i)));if(m&&jt(s,m))return!1;return n.some((d)=>{let f=hs(d);if(f&&op.basename(s)!==F(f.name))return!1;let p=F(Rr(f?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return jt(s,p)&&!(f&&s===p)})}function tA(e){let t=e.split("/");return t.some((n)=>Yw.has(n))||Zw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function nA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ms)if(r===o.extension&&at(o.id,t))return o.id;for(let o of fs)if(o.pattern.test(r)&&at(o.id,t))return o.id;return null}function F(e){return e.toLowerCase()}function at(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=cl(e,n,r);if(!i)return"";if(!o)return i;let s=ul(i,o),a=di(s)?s:Ue(fi(t,s)),l=Ue(z(a,n.paths,r));if(!jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function rp(e,t){return e===t||e.startsWith(`${t}/`)}function rA(e,t,n,r){let{home:o,normalized:i}=cl(e,n,r);if(!i||!o)return"";let s=ul(i,o),a=op.normalize(di(s)?s:Ue(fi(t,s))),l=Ue(Se(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&jt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Rr(e,t,n,r){let{home:o,normalized:i}=cl(e,n,r);if(!i)return"";let s=o?ul(i,o):i;return Ue(z(di(s)?s:fi(t,s),n.paths,r))}function cl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ue(z(Se(r),t.paths,n)):"",i=Ue(Se(oA(nt(e,t))));return{home:o,normalized:i}}function oA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return k_(e)}catch{return e}}function ul(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function iA(e){if(process.platform==="win32")return!0;return I_.parse(e).root.length>1}function Ue(e){let t=e.trim(),n=(t.includes("\\")&&iA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function He(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var sA={findPolicyMutation:jf,findGitMetadataMutation:Sd,resolveGitMetadata:aA,loadPolicySnapshot:au,findSensitiveTarget:cp,analyzeCommand:Lf,getModes:Wi};function yp(e,t){let n={...sA,...t.dependencies},r=uA(e),o=_r(e)?e.command:r,i=Et("policy-protection",o,()=>ir(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(_r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Fd,intent:"stop_and_explain"}};let l=be(),c=Et("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Et("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Hf,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=Et("policy-protection",o,()=>zf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ff,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=Et("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=Et("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...lA(f)},y=p.secretProtection.enabled===!1?null:Et("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:_r(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:ip,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!_r(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...dl("command-validation",o),...h};let C=Et("command-analysis",o,()=>Wf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},cA(i),i.store),e.command,t.trace));if(C.decision){let E=!g.strict&&C.decision.kind==="deny"&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===cr&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(C.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:E?{...C.decision,ask:!0}:C.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function aA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function lA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function cA(e){return ge(e,"declared-command")?.program}function uA(e){try{return On(e.input)}catch(t){let n=_r(e)?e.command:void 0;throw new Vt("policy-protection",dl("policy-protection",t instanceof Xe?void 0:n,t),t)}}function Et(e,t,n){try{return n()}catch(r){throw new Vt(e,dl(e,r instanceof Xe?void 0:t,r),r)}}function dl(e,t,n){let r=n instanceof D||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Ci:Pn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function _r(e){return e.route.kind==="command"}import{appendFileSync as xA,mkdirSync as RA}from"fs";import{isAbsolute as _A,join as pl}from"path";import{lstatSync as Sp,readdirSync as dA,readFileSync as mA,rmdirSync as fA,statSync as Cp,unlinkSync as pA,utimesSync as gA,writeFileSync as hA}from"fs";import{join as wr}from"path";function bp(e,t={}){return eo(en(e,t),e.home).policy.audit.retention_days}var fl=86400000,yA=".last-prune",bA=/^\d{4}-\d{2}$/,SA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,vp=(e)=>Math.floor(e/fl);function xp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Cp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=wr(t,yA),i=Cp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&vp(i)===vp(r))return;let s=r-bp(e)*fl,a=new Date(r).toISOString().slice(0,7);for(let l of ml(t)){if(l.isDirectory()){CA(wr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))vA(wr(t,l.name),s)}hA(o,"",{mode:384}),gA(o,r/1000,r/1000)}catch{}}function CA(e,t,n){for(let r of ml(e)){if(!r.isDirectory()||!bA.test(r.name))continue;let o=wr(e,r.name);for(let i of ml(o)){if(!i.isFile())continue;let s=SA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+fl;if(!Number.isFinite(a)||a>=t)continue;Rp(wr(o,i.name))}if(r.name!==n)Ep(o)}Ep(e)}function vA(e,t){try{let n=Sp(e);if(n.mtimeMs>=t)return;let r=mA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(EA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Sp(e).mtimeMs!==n.mtimeMs)return;Rp(e)}catch{}}function EA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ml(e){try{return dA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Rp(e){try{pA(e)}catch{}}function Ep(e){try{fA(e)}catch{}}var wA="2.4.11",AA=1e4,PA=2000,TA=256,IA=32768;function kA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function OA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function gl(e,t,n,r,o,i,s={}){let a=kA(t);if(!a)return;let l=DA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=gi(ct(n),s.failureStage?Number.POSITIVE_INFINITY:AA),m=gi(ct(r),PA),d=s.toolName?gi(ct(s.toolName),TA):void 0,f=i===null?void 0:gi(ct(i),IA),p=pl(l,OA(f?.value??null),c.slice(0,7));RA(p,{recursive:!0,mode:448});let g=pl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Fi)(),v:wA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};xA(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),xp(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function MA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&_A(n)?n:null}function DA(e){let t=MA(e);return t?pl(t,".cc-safety-net","logs"):null}function wp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=_p(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?_p(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function _p(e){return"command"in e?e.command??"":""}function Ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;gl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Pp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;gl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Ip(e,t,n){try{let r=yp(t,{environment:e,...n.guard});return Tp(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Tp(e,t,r.evaluation,n,!(r.cause instanceof Xe),{stage:r.stage,errorCode:NA(r.cause)}),r}}function Tp(e,t,n,r,o=!0,i){Ap(e,wp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function NA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Xe)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Kt(e,t={}){return{malformed:!0,denial:Tn(t),cwd:e}}function kp(e,t={}){return(n,r)=>{try{return LA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Tn())}}}function LA(e,t,n,r){let o=Jl();if(n.cancelled?.(t))return n.block(Tn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Pp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Sl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Ip(o,i,{guard:{auditAllowed:Ql(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${vl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var WA={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>FA(e,t,n),getSessionId:(e)=>BA(e),allow:{action:"allow"},block:(e)=>UA(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Op=GA();function GA(e={}){return kp(WA,e)}function FA(e,t,n){if(!e||typeof e!=="object")return Kt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Kt(null);if(!r.input||typeof r.input!=="object")return Kt(null,{toolName:r.tool});let o=zA(t,n);if(!o)return Kt(null,{toolName:r.tool});let i=$A(t,e);if(!i.ok)return Kt(o,{toolName:r.tool});if(!i.command)return Yt(r.tool,r.input,{kind:Ri(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Kt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?jl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return Yt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function zA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Hl(".",[r],t)}catch{return}}function $A(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function BA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function UA(e){return{action:"reject-and-continue",message:Cl(e)}}function HA(e){e.on("tool.call",(t)=>Op(t,e))}export{HA as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function vr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function Rn(e){return e?w(e):""}function zm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(De(e,"posix"),t)}function Er(e){return Wa(e,new Set(Array.from(e.matchAll(Mm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||Bm(r.words,n))return!0;Jx(r,n)}return!1}function Bm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Sr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Om(e[s],t)}if(q.has(o)){let s=e.slice(n),a=Ee(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Om(s[l],t)}let i=qx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Bm(e.slice(i),t)}function qx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Yx(e,t+1);if(r==="exec")return Zx(e,t+1);if(r==="env")return Xx(e,t+1,n);return null}function Yx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Zx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Xx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Sr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Sr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Jx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(Sr(n,t))t.add(r.name)}}function Sr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Mm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Bx.test(o)||t.has(o))}))}function Om(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Sr(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Qx="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",eR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,nR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,rR=/^(?:[0-9]+|[@*])$/;function Hm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Vt(n),i=n.slice(r),s=S("xargs.shell-dynamic",Fa);if(iR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=Zm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&qm(l,o),u=t.analyzeChild(l,{...Ut(a,t),dynamicInput:d,dynamicSourceInput:m||Vm(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ga)});if(u)return u;let f=oR(l,o,t.policy?.rules??[],T(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,Qx]:l,h=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(p,{...Ut(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function oR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function jm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Pm(e,r,t.length,n);return o===null?[]:[o]}function Vm(e,t,n,r,o,i,s){if(q.has(t)){if(st(e))return!1;if(n!==null&&sR(e,n,s))return!0;let a=$e(e);if(!a){let l=lt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Km(a,n,s))return!0;if(Ae(a))return!0;return aR(a,n,r)}if(Me(t))return $m(e,n,Ro,Yu(t));if(we.has(t))return $m(e,n,ya,Yd);if(t==="eval"){let a=Qo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return lR(e,n,i);if(t==="git"){let a=_e(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&Ym(a.rest,n).some((l)=>l.includes(n))}return!1}function Km(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function $m(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>jm(l,t,a))));return Xo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function iR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(ze(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function qm(e,t){return Ym(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Ym(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Zm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function sR(e,t,n){let r=Ee(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Km(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return jm(a,t,s).some((d)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,d):f),u=Ee(m);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(m[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(m[u.scriptIndex]??"").includes(d)})}))}function aR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(eR))if(Um(o,r))return!0;for(let o of e.matchAll(tR))for(let i of(o[1]??"").matchAll(nR))if(Um(i,r))return!0;return Wa(e,r)}function Um(e,t){let n=e[1]??e[2];return n!==void 0&&(rR.test(n)||t.has(n))}function lR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=vn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let d=Zm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&qm(c.tokens,t)||Vm(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=at(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Vt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var xr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Rr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",uR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",dR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,Xm=/\{\}|\{-?\d+\}/g,mR=["e","f","source","file","-e","-f","--source","--file"],fR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],pR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),gR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Jm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),hR=new Set(["--workdir","--wd"]),Qm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function of(e){return Ie([...e],(t)=>Ae(t))}function sf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=_n(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=gf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let g=_n(t);if(g)return g;let p=of(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=ER(t);if(g)return g}if(d!==void 0&&a){let g=_n(t);if(g)return g}let u=xR(d,t.cwd,t.environment.paths);if(u===null){let g=_n(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...ze(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some($a)){let p=_n(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=uf(f.envAssignments,f.cwd,a);return Ie(g,(h)=>t.analyzeNested(h,p))}return Ie(ze(i,f),(g)=>yR(g,o,t,f))}function yR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(ff)){let h=_n(n);if(h)return h}let d=of(c);if(d)return d;let m=c.some(F),u=i||m,f=a&&u,g=uf(e.envAssignments,e.wrapperCwd,s||f);if(q.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(ri(l,E,n.budget),Ut(e,r)))};if(st(l))return h();let y=$e(l);if(y){if(pf(y)){let x=_t(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(nf(y,A,n.budget),g))}if(F(y)){if(o.length>0)return Ie(o,(Y)=>n.analyzeNested(nf(y,Y,n.budget),g));let x=Cr(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let Y=tf(n);if(Y)return Y}let A=x?n.analyzeChild(x,{...Ut(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",Rr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)}):null;if(A)return A;return n.analyzeNested(y,g)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>ei(K(x===void 0?l:i?l.map((A)=>df(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=_t(n);if(x)return x}let b=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(b.length>0)return n.budget.charge("derivedTokens",b.length),Ie(b,(x)=>n.analyzeNested(x,g));if(Er(y)){let x=_t(n);if(x)return x}let P=n.analyzeNested(y,g);if(P)return P;if(u)return _t(n);return null}let v=lt(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return _t(n)??h();if(v.kind==="literal")return h();if(o.length>0){let E=_t(n);if(E)return E;let b=h();if(b)return b;if(i)return null;let P=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",P.length),Ie(P,(x)=>n.analyzeNested(x,g))}if(u||a)return _t(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>za(ri(l,y,n.budget,Xm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>za(rf(l,y,n.budget),e.cwd,r));let h=za(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Xm,"")]:[]}),e.cwd,r);if(h)return h;return tf(n)}let p=o.length>0?o:[void 0];return Ie(p,(h)=>{let y=h===void 0?l:i?ri(l,h,n.budget):rf(l,h,n.budget),v=S("parallel.shell-dynamic",Rr),E=a&&e.head==="find"?vR(y,r):null,b=lf(y,a,n)??E?.customResult??null,P=O(e.head),x=a&&(P==="rm"&&Ba(y)||P==="xargs"&&cf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&af(y,P)),Y=n.analyzeChild(y,{...Ut(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:x,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)});if(A){let ke=T(v,n.policy);if(ke)return ke}return Y??b??it(y,n.policy?.rules??[])})}function af(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(q.has(t))return SR(e);if(t==="git")return bR(e);if(t==="find")return!0;if(we.has(t))return ef(e,mR,yr);if(Me(t))return ef(e,fR,xo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||pf(o)))}function bR(e){if(CR(e))return!0;let t=_e(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function CR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function SR(e){if(st(e))return!1;let t=$e(e);if(t!==null)return F(t);let n=lt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function ef(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Qm]).some((o)=>o.value===Qm);return Xo(r,t,(o)=>n(e.map((i)=>df(i,[o]))))}function lf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return _t(n);return Ie(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function vR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=af(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&cf(a.tokens),n.customResult??=lf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=F(a);continue}let l=at(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function cf(e){let t=e.slice(Vt(e).childStart);return O(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>T(S(e,t),n.policy)}var _t=ii("parallel.shell-dynamic",Rr),ER=ii("parallel.command-stream-dynamic",uR),_n=ii("parallel.command-stream-dynamic",dR),tf=ii("parallel.rm-recursive-force-dynamic",xr);function za(e,t,n){return T(Jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function uf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function df(e,t){return e.replace(oi,(n)=>mf(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=mf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function nf(e,t,n){return ri([e],t,n)[0]??""}function rf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function mf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(oi)!==-1}function ff(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function pf(e){return/^\{[^{}\s]*\}$/.test(e)}function xR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!cR(e))return null;try{return yt(t??e,e,n)}catch{return null}}function gf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Sa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Sa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let p=e[t+1],h=g.indexOf("="),y=h===-1?g:g.slice(0,h),v=h===-1?void 0:g.slice(h+1);if(g==="--dry-run"){l=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){c||=(g==="-I"?p:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){c=!0,t+=2;continue}if(y==="--replace"||g.startsWith("-i")&&g.length>2){let E=y==="--replace"?v:g.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||gR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(g==="--pipe"||g==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Jm.has(y)||g.startsWith("-S")&&g.length>2){i=!0,t+=Jm.has(g)?2:1;continue}if(hR.has(y)){c=!0;let E=v??p;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&v!==void 0){t++;continue}if(pR.has(g)){if(p===void 0||p===":::"||p==="--"){c=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}c||=n.some(l?$a:ff);let d=[];if(o!==-1){let g=[];for(let p=o+1;p<e.length;p++){let h=e[p];if(h===":::"){d.push(g),g=[];continue}if(h!==void 0)g.push(h)}d.push(g)}c||=d.length>1;let m=RR(d),u=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function RR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function hf(e){return gf(e).childStart}var _R="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function bf(e,t,n,r,o=!1,i){let a=(Yn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",_R):null;return T(a,i)??Cf(e,t,n,o,i)}function Cf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=mn(e,t),l=AR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",si),o);if(T(Zo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return T(S("shell.dynamic-structure",si),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&PR(t)?T(S("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",si),o):null}if(s==="xargs")return yf(e,t.slice(Vt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return yf(e,t.slice(hf(t.map(w))),"parallel",n,r,o);return null}function yf(e,t,n,r,o,i){if(t.length===0)return null;let s=wR(t,r);if(Yn(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?Fa:Rr),i);if(l)return l}let a=Cf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:xr),i);return null}function wR(e,t){let n=Wt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function AR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function PR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=at(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Co(t[n.tokenIndex],n.value)})}var TR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",IR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",kR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Sf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",TR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",IR);if(e==="shred"&&n.length>0)return S("shred.target",kR);return null}var Ef=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Zo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>nm(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Hm(e.words,{...vf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>sf(e.words,{...vf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})}];function vf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Kt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function wf(e){return Ef.find((t)=>t.heads.has(e))?.analyze}function An(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?w(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=Ao(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let R=[...g,...i(f.words)].join(" "),k=Ae(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),ue(k);if(n.strict)return ye(r);let L=Po(g,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(te)return te}}let p=f.rewritten?K(i(f.words)):mn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>p.length){let R=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-p.length),output:h})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if($t(E))throw new D("wrapperPeelIterations");let b=O(E),P=f.cwd===null?void 0:f.cwd??d,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,Y=s?s.allowTmpdirVar:!mr(v,n.environment),ke=bf(o,f.words,n.environment,t===0,n.strict,n.policy);if(ke)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ke.reason}),ue(ke);let je=Ho(h,n.policy);if(je){for(let R of[je.childIndex,...je.alternativeChildIndices]){xf(y.wrapperNormalizationBudget);let k=p.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:je.wrapper,output:i(k)});let L=An(k,t,{...y,effectiveCwd:A,envAssignments:v});if(L)return L}return null}let de=l?void 0:b==="eval"?Qo(p):b==="trap"&&!a?Lm(p):void 0;if(a&&s&&b==="eval"){if(de?.kind==="dynamic")return wn(s,n.policy);if(de?.kind==="literal"){let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v});if(R)return R}return Pn(s,n.policy)}if(de?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(de?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:de.source,depth:t+1});let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?q.has(b):Pf(E,b)){if(st(h))return null;if(a&&s){let R=$e(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=wn(s,n.policy);if(L)return L}if(Er(R)){let L=wn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:v})}let k=lt(p);if(k.kind==="dynamic")return wn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?wn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?wn(s,n.policy):null}if(l){let R=$e(h),k=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:v}):lt(p).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=NR(h,v,A,n,r,t);if(R)return R;let k=$e(h);if(k){let Qt=ei(p,k);if(Qt.kind==="dynamic")return ye(r);let Si=Qt.kind==="literal"?Qt.source:Wm(p,k),vl=LR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:vl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:vl,depth:t+1});let El=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(El)return El;return Er(Si)?ye(r):null}let L=lt(p,n.strict?void 0:n.shellAssignments);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ai(L.source,A,v,n,r,t);let te=Gm(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let R=h[1]==="-p"?2:null;if(R!==null){let Qt=n.commandView?p[R]:void 0;if(!Qt)return null;if(Qt.provenance!=="literal")return ye(r)}let k=R===null?1:3,L=h[k]==="--"?k+1:k,te=n.commandView?p[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,A,v,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(we.has(b)&&!l){if(!s&&n.strict&&ja(yr(h),p))return ye(r);let R=Zd(h,(L)=>Kt(n.analyzeNested(L,{effectiveCwd:A,envAssignments:v}))),k=T(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),ue(k)}if(Me(b)&&!l){if(!s&&n.strict&&ja(xo(h),p))return ye(r);let R=qu(h);if(a&&s)return MR(b,R,A,v,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:R,paranoidBlocked:k}),k){let te=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(te)return ue(te)}if(Ys(b,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:v});if(L&&!Af(L,R))return L;if(or(R,void 0,!n.strict)){let te=T(S("interpreter.dangerous-command",gn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:gn}),ue(te)}r=void 0}}if(b==="busybox"&&h.length>1)return xf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),An(p.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let G=s?null:T(Sf(b,h),n.policy);if(G)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:G.reason}),ue(G);let J=r===y.trace?y:{...y,trace:r},X={words:p,head:b,cwd:P,originalCwd:x,envAssignments:v,allowTmpdirVar:Y,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:J,analyzeChildTokens:(R,k)=>a&&s?Ka(R,t,J,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Kt(An(K(R),t+1,{...J,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??it(R,J.policy.rules),analyzeChild:(R,k)=>Ka(R,t,J,k)},Q=s&&(b==="xargs"||b==="parallel")?void 0:wf(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Y});let be=r&&b==="git"?Am(X.words,Va(X)):void 0,dt=Rf(be?be.match:Q?.(X)??null,n.policy);if(r)WR(X,dt,be?.relaxation??null);if(dt)return ue(dt);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Pn(s,n.policy):null)??DR(s,n.policy)}let Or=!s&&Q===void 0&&!jr.has(b),Je=r&&Or?[]:void 0;if(Or)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;Je?.push(k);let L=Rf(OR(h,R,t,J,P,x,A,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[],embeddedCommandFound:O(k)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[]}),l&&s&&!s.wrappedByTransparent)return null;let Mr=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Mr,reason:Mr?.reason}),Mr)return ue(Mr);return a&&s?Pn(s,n.policy):null}function Ka(e,t,n,r){return Kt(An(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function OR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=O(c);if(Pf(c,d)||wf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Ka(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!mr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function MR(e,t,n,r,o,i){if(!t)return Pn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",rr),o.policy);if(a)return ue(a)}if(Ys(e,t))return Pn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Af(s,t))return s;if(or(t,void 0,!o.strict)){let a=T(S("interpreter.dangerous-command",gn),o.policy);if(a)return ue(a)}return Pn(i,o.policy)}function Af(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Bo)||e.reason===Sn)&&!Vr(t);return n||r}function wn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?ue(n):null}function Pn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?ue(n):null}function DR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?ue(n):null}function NR(e,t,n,r,o,i){let s=tm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=nr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function LR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function WR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function xf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:gr}),ue(GR())}function GR(){return{id:"",reason:gr,intent:"stop_and_explain"}}function Pf(e,t){return q.has(t)||e==="$SHELL"||e==="${SHELL}"||q.has(I(t))}function Rf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var FR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,zR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function BR(e,t){let n=kf(e,t);if(n.length===0)return!1;let r=n[If(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return FR.test(e.join(" "))}function Tf(e,t,n,r,o){if(e.dialect==="powershell"){let y=$R(e.words,o);if(y.kind==="none")return;if(!t||y.kind==="unknown")return null;return _f(VR(y.target),t,n.paths)}let i=e.words.map(w),s=i.some((y)=>/^CDPATH\+?=/.test(y));if(!BR(i,n))return s?null:void 0;if(!t)return null;let a=kf(i,n,t),l=If(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((y)=>y.length<=1||!y.startsWith("-")||y==="--");if((d===-1?c:c.slice(0,d)).some((y)=>!/^-[LP]+$/.test(y)))return null;let u=d===-1?[]:c.slice(d),f=u[0]==="--"?u.slice(1):u;if(f.length!==1)return null;let g=f[0]??"",p=e.words.find((y)=>y.provenance==="variable"&&y.text===g),h=p?Ye(p,r):g;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return _f(h,t,n.paths)}function _f(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=yt(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function $R(e,t){let n=UR(e[0])?1:0,r=e[n];if(!HR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!zR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return jR(e.slice(n+1),t)}function UR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function HR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function jR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function VR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function If(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function kf(e,t,n){let r=KR(e);return bt([...r],t,n)}function KR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var e_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",qt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Qa(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return Ja(e,n);let d=`${Bo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Wf(e,n),{reason:Sn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Wf(e,n),{reason:Sn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ja(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=gm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let m=e.nodes[c+1],u=m?.kind==="connector"?m.operator:void 0,f=t_(e,c,d,a,u),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],v=a==="&&"?p?.failure??[]:[],E={connector:a,skippedSuccessStates:y,skippedFailureStates:v};if(wt(u)&&!wt(a))l=E;let b=wt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??E:E,P=Yt(b.connector)||Yt(u);if(d.kind==="function"){let j=h.flatMap((J)=>{let X=In(J);return X.functionDefinitions.set(d.name,d.body),qa(J,[X],f,u==="&",Yt(u))}),G=Ya(j,[],b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=G.states,s=G.conditionalStates,a=void 0;continue}if(d.kind==="group"){let j=[],G=[];for(let X of h){let Q=ui(d.body,t,n,r,[In(X)]);if(Q.result)return Q;if(j.push(...qa(X,Q.states,f,u==="&",Yt(u))),P)G.push(X,...f?Q.states.map((be)=>li(X,be)):Q.states)}let J=Ya(j,G,b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=J.states,s=J.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[c-2],Y=wt(a)&&A?.kind==="command"?Nm(A)??r_(A):void 0,ke=[],je=[];for(let j of h){let G=o_(d,t,n,r,[In(j)]);if(G.result)return{result:G.result,states:i};let J=e.dialect==="powershell"?G.states:G.states.map((X)=>li(j,X));for(let X of J){let Q=In(X),be=a_(d,t,n.trace?{...n,trace:Gf(n.trace,x)}:n,r,Q,wt(a),Y);if(be)return{result:be,states:i};let dt=A_(d,Q.functionDefinitions);if(dt)n.budget.charge("derivedTokens",di(dt));let On=dt?t+1>=V.recursionDepth.cap?Za(d.displayText,n,[Q]):ui(dt,t+1,n,r,[Q]):{result:null,states:__(d,Q)};if(On.result)return On;ke.push(...qa(j,On.states,f,u==="&",Yt(u)));let Or=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==X.effectiveCwd&&d.redirections.every((Je)=>["<",">",">>",">|"].includes(Je.operator)&&Je.target?.text==="/dev/null");if(P&&!Or)je.push(j),je.push(...On.states.map((Je)=>f?li(j,Je):Je))}}let de=Ya(ke,je,b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=de.states,s=de.conditionalStates,a=void 0}return{result:null,states:i}}function t_(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&n_(e,t)}function qa(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>Tn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function n_(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(i_(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function r_(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Yt(e){return e==="&&"||e==="||"}function Ya(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=Yt(i)?s:void 0;return{states:Yt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function Gf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function o_(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=s_(e);if(s){if(t+1>=V.recursionDepth.cap)return Za(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Za(s,n,o);if(a.status!=="complete")return Of(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return Of(i,n,r,o)}function i_(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Of(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[In(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function s_(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Za(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,intent:"stop_and_explain"},states:[...n]}}function a_(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:m_(n.environment.paths,o.createdDirectories,n.budget)}},l=b_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Ff(e,o,"before-consumer",a.environment.paths,a.budget);let c=mn(e.dialect,e.words),d=c.map(w),m=e.displayText,u=fm(c,o.shellGitContextState),f=ym(u,o.shellGitContextState);if(e.dialect==="powershell"){let h=T($d(e,i,T_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return P_(m,h)}if(d.length===1&&d[0]?.includes(" ")&&!Yn(e.dialect,e.words)){let h=T(Ae(d[0]),a.policy),y=h!==null&&!a.strict&&Hu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let v=Mf(e,l,o,f,s,a);if(v)return v;return Ia(u,o.shellGitContextState),null}let g=An(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Qa(h,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Gf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:m};let p=Mf(e,l,o,f,s,a);if(p)return p;return Ia(u,o.shellGitContextState),null}function Mf(e,t,n,r,o,i){let s=C_(e,t,n,r??new Map,i);if(s)return s;return Ff(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),u_(e,t,n,i.environment.paths,i.budget),f_(e,n,i.environment.paths,i.budget),E_(e,n,o,i.environment,i.trace),null}var l_=new Set([">>","<>"]);function Ff(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?c_(s):l_.has(s.operator)))continue;Df(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=Bf(e.words.slice(1));if(!i)return;for(let s of i.operands)Df(s,t,r,o)}function c_(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Df(e,t,n,r){let o=e?.provenance==="literal"?nr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function u_(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of d_(e,n.shellGitContextState.shellAssignments)){let a=nr(s,n.effectiveCwd,r,o);if(!a||!Ku(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function d_(e,t){let n=Xa(h_(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return g_(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=Bf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Xa(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Xa(e,t){if(y_(e))return e.text;return(e&&Ye(e,t))??void 0}function m_(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=N(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${QR}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?N(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function f_(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Xa(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!YR(c)&&!l)continue;let d=N(JR(l??"",c),n,r);if(a?p_(d,n):n.isDirectory(qR(d))&&zf(d,n))t.createdDirectories.add(d)}}function p_(e,t){let n=XR(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>ZR(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||zf(o(i),t)}function zf(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function g_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function h_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Bf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function y_(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function el(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function b_(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return qt;let r=n[0];if(!r?.heredoc)return qt;let o=/\$\(|`/.test(r.heredoc.body);if(!el(r.heredoc)&&(!t||o))return e_;if(r.fd!==void 0&&r.fd!==0)return qt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return qt;let i=e.redirections.some((l)=>l!==r&&Nf(l.target));if(se(e.words[0],"cat"))return i?qt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Nf)?qt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return qt}function Nf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function C_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(v_(e,i,n,r,o))return null;let a=S_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ja(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function S_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!el(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(m)return m}if(!or(l,void 0,!n.strict))return null;let d=T(S("interpreter.dangerous-command",gn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function v_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!el(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!q.has(l)&&!q.has(I(l)))return!1;return st(a)}function E_(e,t,n,r,o){let i=Tf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var x_=/^[A-Za-z_][A-Za-z0-9_]*$/,R_=8;function __(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!x_.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=R_&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=In(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function In(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:hm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories)}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>w_(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function w_(e,t){return e.effectiveCwd===t.effectiveCwd&&Tn(e.shellGitContextState.env,t.shellGitContextState.env)&&Tn(e.literalHeredocFiles,t.literalHeredocFiles)&&Tn(e.functionDefinitions,t.functionDefinitions)&&Tn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Tn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Lf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Lf(e.createdDirectories,t.createdDirectories)}function Lf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Tn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function A_(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function P_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function T_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ja(e,t){let n=T(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Wf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Sn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var I_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function $f(e,t,n,r){let o=Qa(e,0,{...t,...mu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Uf(e,t,n){try{return{decision:e()}}catch(r){let o=k_(r,t,n);if(!o)throw r;return o}}function k_(e,t,n){if(!(e instanceof D)||!I_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var O_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),nl=new Set(["cc-safety-net","ccsn"]),M_=new Set(["bunx","npx","pnpx"]),D_=new Set(["pnpm","yarn"]),N_=new Set(["npm","pnpm","yarn"]),L_=new Set(["bun","node"]);function fi(e,t,n={}){if(nl.has(e))return 0;if(M_.has(e)){if(n.broad)return tl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&N_.has(e)&&n.broad&&t[r]==="exec"){let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(D_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(L_.has(e)){let o=n.broad&&r!==-1?r:0;if(Hf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Hf(t[o+1]))return o+2}return null}function tl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return nl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return nl.has(e.slice(0,t))}function Hf(e){let t=e?.replaceAll("\\","/");return[...O_].some((n)=>t===n||t?.endsWith(`/${n}`))}var jf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Vf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=yn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>W_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function W_(e,t){let n=bt([...e],t),r=n.slice(1),o=fi(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"path";var Zf="This path contains the protected policy config and you must not modify or delete it.",G_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Xf(e,t,n){let r=H_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?qf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=qf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Nr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>_r(a,n,r,o,i));return s?{target:s}:null}function qf(e,t,n,r,o){let i=yn(e,t,r,o,{findSegmentTarget:(s,a)=>F_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>_r(s,a.cwd,n,r,o),findMalformedTarget:(s)=>U_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function F_(e,t,n,r,o){if(cr(e))return null;let i=Ct([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&z_(a)){let l=B_(a).find((c)=>Yf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ko(i,1)||Ea(i,r)){let c=(br(K(i))??K(["."])).find((d)=>{let m=pe(d.text,t.variables);return _r(m,t.cwd,n,r,o)||Yf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Do(a).sources.find((c)=>j_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if($_(i,s))return null;for(let l of[...e,...i])for(let c of Jf(l))if(_r(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function z_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function B_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function $_(e,t){if(!G_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function U_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Jf(i))if(_r(s,t,n,r,o))return{target:s};return null}function Jf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function H_(e,t,n){let r=(a)=>wr(ae(a,e.executionCwd,t,n)),o=r(sn(t)),i=[r(Hn(e.executionCwd)),r(Hn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function _r(e,t,n,r,o){let i=jl(e,t,r,o,(s)=>wr(s)===Ur);return i!==null&&n.files.has(wr(i))}function Yf(e,t,n,r,o){return n.directoriesAndAncestors.has(wr(ae(e,t,r,o)))}function j_(e,t,n,r,o){let i=wr(ae(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function wr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as up,resolve as yi,win32 as V_}from"path";import{fileURLToPath as K_}from"url";var dp="Access to a sensitive path is not allowed.",mp=new Set(["echo","printf"]),q_=new Set(["find"]),Y_=new Set(["!","do","elif","else","if","then","until","while"]),Z_=new Set(["-exec","-execdir"]),X_=new Set([";","+"]),J_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Q_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),fp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),ew=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),tw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),pp=new Set(["-c","-e","-r","-E","--eval","--exec"]),nw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),rw=new Set(["grep","rg"]),ow=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),iw=new Set(["commit","merge","notes","stash","tag"]),sw=new Set(["-m","--message"]),aw=new Set(["--grep"]),Qf=new Set(["jq","gojq","jaq"]),ep="f",tp="file",lw="files",cw=new Set(["e","f"]),uw=new Set(["regexp","file"]),dw=new Set(["e","f","A","B","C","m"]),mw=new Set(["regexp","file","after-context","before-context","context","max-count"]),rl="__CC_SAFETY_NET_PIPE_INPUT__",il=/[\w./~@+-]*[./~][\w./~@+-]*/g,fw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,pw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,gw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,np=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,rp=/\b(?:system|exec|spawn|popen)\s*$/,hw=/\b(?:eval|exec)\s*\(/g,yw=/\b(?:eval|exec)\s*$/,bw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function op(e,t,n,r,o,i){for(let s of e){let a=s.target;if(gA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=fA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(vp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!al(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!al(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&hA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function gp(e,t,n,r,o={}){let i=ip(e,n,r),s=op(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=op(i,t,e.invocation.context.configCwd,n,r,new Set(ip(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&Cw(e,n)?null:a}function Cw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Mo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=ut(r);if(o.length===0)return!1;let i=He(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return ll(i,o.slice(1))}function ll(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>J_.has(n))}function ip(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?kn(s.shell,e.store,r,t,o,n,Sw(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function Sw(e){return e.program.dialect==="powershell"}function kn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Zw(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(kw(c,s),r);return Oo(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...bi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...Ew(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...hp(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>xw(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:d.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function cl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?kn(s,t,n,r,o,i):null}function bi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(Qf.has(He(ut(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...bi(p,t,n,r,o,i)]}let l=Iw(e).map(a),c=ut(e);if(c.length===0)return l;let d=c[0]??"",m=He(d).toLowerCase(),u=c.slice(1),f=c.findIndex((p)=>!Y_.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&ll(He(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=vw(d,m,u);if(g)return[...l,...g.map(a)];if(mp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...yp(e).map(a)]:l;if(m==="eval")return[...l,...cl(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Xe(m,p)).map(a)];if(m==="git")return[...l,...Mw(u).map(a)];if(m==="gh")return[...l,...sl(m,u,ow).map(a)];if(Qf.has(m))return[...l,...Ow(u).map(a)];if(rw.has(m))return[...l,...oA(u).map(a)];if(q_.has(m))return[...l,...Ww(u,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...u.flatMap((p)=>Xe("awk",p)).map(a),...u.flatMap((p)=>Fw(p,t,n,r,o,i)),...u.flatMap(zw).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>Xe(m,p)).map(a),...Dw(u).map(a)];if(ur(m)){let p=lr.has(m)?Ee([m,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...kn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...Gw(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>Xe(m,p)).map(a)]}function vw(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Ew(e,t,n,r,o,i,s){if(Aw(t,n,r,o,i,s)){let a=ut(e),l=ll(He(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...yp(e),...l].map((c)=>({target:c,cwd:i}))}return hp(t,Rw(e),n,r,o,i,s,()=>[])}function xw(e,t,n,r,o,i,s){let a=ut(e);if(!ur(He(a[0]??"").toLowerCase()))return[];return cl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function hp(e,t,n,r,o,i,s,a){let l=Pw(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>lr.has(l)?kn(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function yp(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase();if(!mp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ul(r.replaceAll("%%","%"))];return t.slice(1)}function Rw(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return _w(r);return[]}function _w(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ul(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>ww(t,r.slice(i*n,(i+1)*n)))}function ww(e,t){let n=0;return ul(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ul(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Aw(e,t,n,r,o,i){let s=ut(e);if(s.length===0||He(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Vt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,rl]:l.map((m)=>m.split(c).join(rl));return bi(d,t,n,r,o,i).some((m)=>m.target.includes(rl))}function Pw(e){let t=ut(e);if(t.length===0)return null;let n=He(t[0]??"").toLowerCase();if(!ur(n))return null;return Tw(n,t.slice(1))?n:null}function Tw(e,t){let n=dl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(pp.has(o)||bp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(bw.get(n)?.has(o))r++;continue}return!1}return!0}function dl(e){return/^python\d/.test(e)?"python":e}function Iw(e){let t=[];for(let n of e){if(Sp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var sp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function kw(e,t){if(!t||!sp.test(e))return e;return`~${e.replace(sp,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function Ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function Mw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...iw.has(r)?sl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),sw):sl("git",e.slice(n),aw)];if(t.push(...Xe("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function sl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function Dw(e){return e.flatMap((t,n)=>{let r=Lw(t);if(r!==null)return ap(r.flag,r.value);let o=Nw(e[n-1]);return o===null?[]:ap(o,t)})}function ap(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return ol(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return ol(t.slice(n+1))}return t.startsWith("@")?ol(t.slice(1)):[]}function Nw(e){if(e===void 0)return null;if(fp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return fp.has(r)?{flag:r,value:e.slice(n+1)}:null}function ol(e){return e===""||e==="-"?[]:[e]}function Ww(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!Z_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>X_.has(f)),m=d===-1?c:c.slice(0,d),u=bi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!Q_.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Gw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(pp.has(c)||bp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...hi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function bp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return nw.get(t[t.length-1]??"")?.has(dl(e))??!1}function Fw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ba(e)?.commands.flatMap((s)=>kn(t.getShellSyntax(s),t,n,r,o,i))??[]}function zw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Bw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ml),...e.match(il)??[]]}function hi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=Uw(t,$w(e));if(l.kind==="unmaskable")return Bw(t).map(a);let c=l.masked.match(np)!==null||l.literals.some((p)=>rp.test(l.masked.slice(0,p.start))),d=l.masked.match(hw)!==null||l.literals.some((p)=>yw.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!lr.has(e),u=m&&!(Kw(l.masked)||c||d)?[]:l.literals,f=m?Array.from(l.masked.matchAll(np),(p)=>{let h=p.index+p[0].length;return{start:h,end:Xs(l.masked,h)}}):[],g=!m||f.some((p)=>Js(l.masked,p.start))?l.literals:l.literals.filter((p)=>rp.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...u.map((p)=>p.text).filter((p)=>p!=="").map(a),...u.flatMap((p)=>ml(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(il)??[]).map(a),...c?g.flatMap((p)=>cl(p.text,n,r,o,i,s)??[a(p.text)]):[],...d?l.literals.flatMap((p)=>hi(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(il)??[]).map(a)]}function $w(e){let t=dl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Uw(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(pw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Vw(e,o))return{kind:"unmaskable"};let a=t==="python"?Hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=jw(e,c,l);if(d===null)return{kind:"unmaskable"};let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&gw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function Hw(e,t){return fw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function jw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Vw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Kw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(ew.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>tw.has(i)))continue;if(o.length>1)return!0;if(qw(e,r)===".")return!0;if(Yw(e,r+n.length)==="(")return!0}return!1}function qw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Yw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Zw(e,t,n,r,o,i){return tA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...kn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...Xw(a,r)?Jw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Xw(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||He(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Jw(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(ml)}function ml(e){let t=eA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Qw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Qw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function eA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function tA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(jn(o,n))continue;if(Cp(e,r,n)){let i=nA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=rA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function nA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(jn(i,n))continue;if(Cp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function rA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Cp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function oA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===lw)o=!0;if(uw.has(m))r=!0;if(u!==void 0){if(m===tp)t.push(u);continue}if(mw.has(m)){let f=e[l+1];if(m===tp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(cw.has(h))r=!0;if(dw.has(h)){u=h,f=m.slice(p+1);break}}if(u==="")continue;if(f.length>0){if(u===ep)t.push(f);continue}let g=e[l+1];if(u===ep&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!Sp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Sp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var iA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),sA=".env.",aA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),lA=[".env.example.",".env.sample."];function cA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function uA(e){return e.length>0&&!/\s/.test(e)}function al(e,t,n,r){let o=vp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function vp(e,t,n,r){try{return Tr(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var dA=new Set(["node_modules","__pycache__"]),mA=[["vendor","bundle"],["vendor","cache"]];function fA(e,t,n,r,o){if(cA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=z(i.split("/").pop()??""),a=z(i),l=()=>uA(s)||al(e,t,r,o);if(aA.has(s)||lA.some((u)=>s.startsWith(u)))return null;let c=z(CA(e,t,r,o));for(let u of ms){let f=`~/${u.suffixParts.join("/")}`;if((cp(a,f)||cp(c,f))&&ct(u.id,n))return u.id}let d=pA(i,t,n,r,o);if(d)return d;if(iA.has(s))return null;for(let u of ds)if(s===u.basename&&ct(u.id,n))return u.id;if(s.startsWith(sA)&&ct(Zr.id,n)&&l())return Zr.id;for(let u of fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ct(u.id,n)&&l())return u.id}for(let u of ps)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ct(u.id,n))return u.id}if(yA(a))return null;if(!s.includes(".")&&Vn.pattern.test(s)&&ct(Vn.id,n))return Vn.id;let m=bA(s,n);if(m)return m;return null}function pA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=z(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Pr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Ar(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=z(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=z(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Pr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Ar(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Ar(e,s,["credentials"])||Ar(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=z(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=z(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Pr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(z(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Pr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,Ze(d,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Ar(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ze("~",t,r,o),".config","amp")],l=z(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Pr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ze("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||z(e).split("/").at(-1)==="mcp-auth.json"&&Zt(z(e),z(a))}case"secret.cli.cursor.config":{let s=z(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=z(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var lp=new WeakMap;function B(e,t,n,r,o){let i=lp.get(o)??new Map;lp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Ep(e,ce(t,r)))}function Ar(e,t,n){return n.some((r)=>Zt(z(e),z(ce(t,r))))}function Pr(e,t,n,r,o){return Ep(e,Ze(t,n,r,o))}function Ep(e,t){return z(e)===z(t)}function ce(e,...t){return Ue([e,...t].filter(Boolean).join("/"))}function gA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));return n.some((a)=>Zt(s,z(Tr(a,r,o,i))))}function hA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ue(N(Se(a),o.paths,i)):"",c=z(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=z(d?Ue(N(yi(Se(d)),o.paths,i)):l&&Ue(N(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Zt(s,m))return!1;return n.some((u)=>{let f=Cs(u);if(f&&up.basename(s)!==z(f.name))return!1;let g=z(Tr(f?.root??u,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return Zt(s,g)&&!(f&&s===g)})}function yA(e){let t=e.split("/");return t.some((n)=>dA.has(n))||mA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function bA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function z(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";if(!o)return i;let s=pl(i,o),a=gi(s)?s:Ue(yi(t,s)),l=Ue(N(a,n.paths,r));if(!Zt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function cp(e,t){return e===t||e.startsWith(`${t}/`)}function CA(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i||!o)return"";let s=pl(i,o),a=up.normalize(gi(s)?s:Ue(yi(t,s))),l=Ue(Se(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Zt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function Tr(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";let s=o?pl(i,o):i;return Ue(N(gi(s)?s:yi(t,s),n.paths,r))}function fl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ue(N(Se(r),t.paths,n)):"",i=Ue(Se(SA(ot(e,t))));return{home:o,normalized:i}}function SA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return K_(e)}catch{return e}}function pl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function vA(e){if(process.platform==="win32")return!0;return V_.parse(e).root.length>1}function Ue(e){let t=e.trim(),n=(t.includes("\\")&&vA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Zt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function He(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Xt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var EA={findPolicyMutation:Xf,findGitMetadataMutation:xd,resolveGitMetadata:RA,loadPolicySnapshot:du,findSensitiveTarget:gp,analyzeCommand:$f,getModes:zi},xA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function xp(e,t){let n={...EA,...t.dependencies},r=AA(e),o=Ir(e)?e.command:r,i=At("policy-protection",o,()=>dr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Ir(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Ud,intent:"stop_and_explain"}};let l=Ce(),c=At("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=At("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Zf,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=At("policy-protection",o,()=>Vf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:jf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let u=At("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=At("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,..._A(f)},y=g.secretProtection.enabled===!1?null:At("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Ir(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:dp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Ir(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...gl("command-validation",o),...h};let v=At("command-analysis",o,()=>Uf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},wA(i),i.store),e.command,t.trace));if(v.decision){let E=!p.strict&&(v.decision.ruleId==="raw-text.dangerous-command"||v.decision.reason===gr&&!xA.test(v.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:E?{...v.decision,unverifiedByStandardMode:!0}:v.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function RA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function _A(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function wA(e){return ge(e,"declared-command")?.program}function AA(e){try{return Gn(e.input)}catch(t){let n=Ir(e)?e.command:void 0;throw new Xt("policy-protection",gl("policy-protection",t instanceof Qe?void 0:n,t),t)}}function At(e,t,n){try{return n()}catch(r){throw new Xt(e,gl(e,r instanceof Qe?void 0:t,r),r)}}function gl(e,t,n){let r=n instanceof D||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Ei:Dn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Ir(e){return e.route.kind==="command"}import{appendFileSync as zA,mkdirSync as BA}from"fs";import{isAbsolute as $A,join as bl}from"path";import{lstatSync as _p,readdirSync as PA,readFileSync as TA,rmdirSync as IA,statSync as wp,unlinkSync as kA,utimesSync as OA,writeFileSync as MA}from"fs";import{join as kr}from"path";function Rp(e,t={}){return so(sn(e,t),e.home).policy.audit.retention_days}var yl=86400000,DA=".last-prune",NA=/^\d{4}-\d{2}$/,LA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Ap=(e)=>Math.floor(e/yl);function Tp(e,t,n=()=>new Date){try{let r=n().getTime();if(!wp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=kr(t,DA),i=wp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Ap(i)===Ap(r))return;let s=r-Rp(e)*yl,a=new Date(r).toISOString().slice(0,7);for(let l of hl(t)){if(l.isDirectory()){WA(kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))GA(kr(t,l.name),s)}MA(o,"",{mode:384}),OA(o,r/1000,r/1000)}catch{}}function WA(e,t,n){for(let r of hl(e)){if(!r.isDirectory()||!NA.test(r.name))continue;let o=kr(e,r.name);for(let i of hl(o)){if(!i.isFile())continue;let s=LA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+yl;if(!Number.isFinite(a)||a>=t)continue;Ip(kr(o,i.name))}if(r.name!==n)Pp(o)}Pp(e)}function GA(e,t){try{let n=_p(e);if(n.mtimeMs>=t)return;let r=TA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(FA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;Ip(e)}catch{}}function FA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function hl(e){try{return PA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Ip(e){try{kA(e)}catch{}}function Pp(e){try{IA(e)}catch{}}var UA="2.4.12",HA=1e4,jA=2000,VA=256,KA=32768;function qA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function YA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Cl(e,t,n,r,o,i,s={}){let a=qA(t);if(!a)return;let l=XA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Ci(mt(n),s.failureStage?Number.POSITIVE_INFINITY:HA),m=Ci(mt(r),jA),u=s.toolName?Ci(mt(s.toolName),VA):void 0,f=i===null?void 0:Ci(mt(i),KA),g=bl(l,YA(f?.value??null),c.slice(0,7));BA(g,{recursive:!0,mode:448});let p=bl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:UA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};zA(p,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Tp(e,l,s.now)}catch{}}function Ci(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ZA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&$A(n)?n:null}function XA(e){let t=ZA(e);return t?bl(t,".cc-safety-net","logs"):null}function Op(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=kp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?kp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function kp(e){return"command"in e?e.command??"":""}function Mp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Cl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Dp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Cl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Lp(e,t,n){try{let r=xp(t,{environment:e,...n.guard});return Np(e,t,r,n),r}catch(r){if(!(r instanceof Xt))throw r;throw Np(e,t,r.evaluation,n,!(r.cause instanceof Qe),{stage:r.stage,errorCode:JA(r.cause)}),r}}function Np(e,t,n,r,o=!0,i){Mp(e,Op(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function JA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Qe)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Jt(e,t={}){return{malformed:!0,denial:Nn(t),cwd:e}}function Sl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Wp(e,t={}){return(n,r)=>{try{return QA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Nn())}}}function QA(e,t,n,r){let o=nc();if(n.cancelled?.(t))return n.block(Nn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Dp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=xl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Lp(o,i,{guard:{auditAllowed:rc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Xt))throw l;if(Tt(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var eP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>nP(e,t,n),getSessionId:(e)=>iP(e),allow:{action:"allow"},block:(e)=>sP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Gp=tP();function tP(e={}){return Wp(eP,e)}function nP(e,t,n){if(!e||typeof e!=="object")return Jt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Jt(null);if(!r.input||typeof r.input!=="object")return Jt(null,{toolName:r.tool});let o=rP(t);if(!o)return Jt(null,{toolName:r.tool});let i=ql(".",[o],n);if(!i)return Sl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=oP(t,e);if(!s.ok)return Jt(i,{toolName:r.tool});if(!s.command)return en(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return Jt(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Yl(a,i,n);if(!l)return Sl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return en(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function rP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function oP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function iP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function sP(e){return{action:"reject-and-continue",message:Rl(e)}}function aP(e){e.on("tool.call",(t)=>Gp(t,e))}export{aP as default};